NASA Contractor Report 2944 



Reliable Dual-Redundant 
Sensor Failure Detection 
and Identification for 
the NASA F-8 DFBW Aircraft 


loan copy: return to 

™RrlANn N ' CAL UBR «v 
KIRTLAND afb, N. M. 


James C. Deckert, Mukund N. Desai, 
John J. Deyst, Jr., and Alan S. Willsky 


CONTRACT NAS 1-1 39 14 
FEBRUARY 1978 




TECH LIBRARY KAFB, NM 


NASA Contractor Report 2944 


TECH LIBRARY KAFB, NM 


lllllllllflll 


□□kisab 


Reliable Dual-Redundant 
Sensor Failure Detection 
and Identification for 
the NASA F-8 DFBW Aircraft 


James C. Deckert, Mukund N. Desai, 
and John J. Deyst, Jr. 

The Charles Stark Draper Laboratory, Inc. 
Cambridge, Massachusetts 

Alan S. Willsky 

Massachusetts Institute of Technology 
Cambridge, Massachusetts 


Prepared for 

Langley Research Center 

under Contract NAS 1-1 39 14 

NASA 

National Aeronautics 
and Space Administration 

Scientific and Technical 
Information Office 


1978 




TABLE OF CONTENTS 


Section Page 

1 SUMMARY AND INTRODUCTION ' 1 

2 FDI STRUCTURE 9 

2 . 1 Introduction . 9 

2.2 Redundancy Trigger 9 

2.3 The Sequential Probability Ratio Test io 

2.4 Time Trigger 12 

2.5 Failure Identification by the Outer Loop 13 

3 ANALYTIC REDUNDANCY SPRT’s 15 

3.1 Introduction 15 

3.2 Translational Kinematics 16 

3.3 Translational Dynamics 21 

3.4 Rotational Kinematics 24 

3.5 Altitude Kinematics 28 

4 CALCULATION OF FDI SYSTEM PARAMETERS 33 

4.1 Introduction 33 

4.2 Rate Gyros 33 

4.3 Attitude Gyros 37 

4.4 Accelerometers 43 

4.5 Altimeters. 50 

4.6 .Alpha Vanes and Mach Meters 5 2 

4.7 Additional Tests 55 

4.8 Summary 60 

5 QUALITY SPRT's 63 

6 OUTER LOOP LOGIC 69 

6.1 Introduction 6 9 

6.2 Failure Identification - Redundancy Trigger ... 69 

6.3 Failure Identification - Time Trigger 71 

6.4 Additional Outer Loop Tasks 71 


iii 


I 



Section 


Page 


7 SIMULATION RESULTS 73 

7.1 Introduction 73 

7.2 Time Trigger Performance 73 

7.3 Redundancy Trigger Performance 84 

7.4 Hard Failure Identification 89 

8 APPLICATION TO FLIGHT TEST DATA 91 

8.1 Introduction 91 

8.2 Discussion of Flight Data 91 

8.3 Calculation of FDI System Parameters 95 

8.4 FDI Algorithm Modifications 102 

8.5 Injected Failure Identification 105 

8.6 Summary 114 

9 CONCLUSIONS AND RECOMMENDATIONS 159 

Appendix 

A TURBULENCE ESTIMATOR 163 

B AERODYNAMIC COEFFICIENT APPROXIMATION 167 

C SCALE FACTOR FAILURES 171 

D SIMULATANEOUS <j> AND 9 FAILURES 175 

E DESIGN AND PERFORMANCE OF AN ALTITUDE KINEMATICS 

FILTER 179 

E.l Introduction 179 

E . 2 AK Filter Design 179 

E.3 Acceleration Bias Estimation 182 

E. 4 Performance Results 184 

F COMPENSATION OF TURN ERROR IN DIRECTIONAL GYROS .... 189 

F. l Introduction 189 

F.2 Derivation of Turn Error Expression 190 

F.3 Results of Turn Error Compensation of Flight 

Data 196 

F . 4 Summary and Conclusions 199 

LIST OF REFERENCES 208 


IV 



LIST OF ILLUSTRATIONS 


Figure Page 

4-1 Low Turbulence Wind Profile 46 

7-1 Rate Gyro Time Trigger Performance 7 5 

7-2 Accelerometer Time Trigger Performance 80 

7-3 Mach Meter and Alpha Vane Time Trigger Performance . 82 

7-4 Rate Gyro Direct Redundancy Trigger Performance .... 85 

7-5 Accelerometer Direct Redundancy Trigger 

Performance 86 

7- 6 Alpha Vane Direct Redundancy Trigger Performance ... 88 

8- 1 Segment 1 117 

8-2 Segment 1 (cont.) 118 

8-3 Segment 2 119 

8-4 Segment 2 (cont.) 120 

8-5 Segment 3 121 

8-6 Segment 3 (cont.) 122 

8-7 Segment 4 a 123 

8-8 Segment 4A (cont.) 124 

8-9 Segment 4B 125 

8-10 Segment 4B (cont.) 126 

8-11 Segment 4C 127 

8-12 Segment 4C (cont.) 128 

8-13 Segment 4D 129 

8-14 Segment 4D (cont.) 130 

8-15 Segment 5 131 

8-16 Segment 5 (cont.) 132 

8-17 Segment 6 133 

8-18 Segment 6 (cont.) 134 

8-19 Segment 4C, Roll Rate Gyro 1 +BFM Bias at T=29,RK .. 135 

8-20 Segment 4A, Roll Rate Gyro 2 +BFM Bias at T=0,RK ... 136 

8-21 Segment 3, Roll Rate Gryo 2 Fail to Zero at T=0»RK . 137 

8-22 Segment 4C, Pitch Rate Gryo 1 -BFM Bias at T=29,RK. 138 

8-23 Segment 4A, Pitch Rate Gyro 2 +BFM Bias at T=0,RK... 139 

8-24 Segment 3, Pitch Rate Gyro 2 Fail to Zero^RK 140 

8-25' Segment 4C, Yaw Rate Gyro 2 -BFM Bias at T=29,RK.... 141 



List of Illustrations (cont.) 


Figure Page 

8-26 Segment 4A, Yaw Rate Gyro 1 +BFM Bias at T=0,RK 142 

8-27 Segment 3, Yaw Rate Gyro 1 Fail to Zero at T=0,RK.... 143 

8-28 Segment 2, Roll Attitude Gryo 1 -BFM Bias at T=37,RK. 144 

8-29 Segment 2, Pitch Attitude Gyro 1 +BFM Bias at T=37,RK 145 

8-30 Segment 4B , Mach Meter 1 -BFM Bias at T=130 ,TK 146 

8-31 Segment 4B, Mach Meter 1 +BFM Bias at T=160,TK 147 

8-32 Segment 4A, Mach Meter 2 +BFM Bias at T=8?TK 148 

8-33 Segment 4B, Alpha Vane 1 +BFM Bias at T=130,TD 149 

8-34 Segment 4C, Alpha Vane 1 +BFM Bias at T= 36 ,TD 150 

8-35 Segment 4B, Longitudinal Accelerometer 2 +BFM Bias 

at T=80,TK 151 

8-36 Segment 4A, Longitudinal Accelerometer 1 Fail to 

Zero at T=0,TK 152 

8-37 Segment 4A, Lateral Accelerometer 2 -BFM Bias at 

T=12,TD 153 

8-38 Segment 4C , Lateral Accelerometer 2 +BFM Bias at 

T=3 6 , TD 154 

8-39 Segment 4B, Normal Accelerometer 2 -BFM Bias at 

T=90,AK 155 

8-40 Segment 4B, Normal Accelerometer 2 -BFM Bias at 

T=125 , AK 156 

8-41 Segment 4B , Normal Accelerometer 2 -BFM Bias at 

T=140,AK 157 

8-42 Segment 4C, Normal Accelerometer 1 +BFM Bias at 

T=10,AK 158 

A-l Continuous Velocity Estimator 163 

A-2 Residual Processing 164 

E— 1 Segment 2, AK Filter Performance without Additive 

Acceleration Bias 186 

E-2 Segment 2, AK Filter Performance with and 

without Additive Acceleration Bias 187 

F-l Elements of Error Geometry for a Directional Gyro... 191 

F-2 Turn Error Due to Non-horizontal Floor Plane 194 

F-3 Spherical Geometry for Non-horizontal Spin Axis .... 194 

F-4 Turn Error Due to Non-horizontal Spin Axis 196 

F-5 Attitude History for Segments 2, 3, 4A and 4C 201 

F-5 (cont.) 202 

F-6 Segment 4A, Turn Error Compensation Assuming 

Horizontal Spin Axes 203 

F-7 Segment 4A, Turn Error Compensation Assuming 

Non-horizontal Spin Axes 204 


vi 



List of Illustrations (cont.) 


Figure Page 

F-8 Segment 2, Turn Error Compensation Assuming 

Non-Horizontal Spin Axes 205 

F-9 Segment 3, Turn Error Compensation Assuming 

Non-horizontal Spin Axes 206 

F-10 Segment 4c, Turn Error Compensation Assuming 

Non-horizontal Spin Axes 207 

LIST OF TABLES 

Table Page 

I Sensor Information 16 

II Summary of FDI System Parameters 61 

III Attitude Gyro and Altimeter Simulation Results .... 89 

IV Hard Failure Simulation Results 90 

V Flight Data Segment Times 91 

VI Minimum BFM and Standard Deviation Data 9 7 

VII New BFM Levels 101 

VIII Self-Test Thresholds 104 

IX AP-101 Execution Times 161 

B.l Worst-Case Acceleration Error due to Polynomial 

Approximation 170 



RELIABLE DUAL-REDUNDANT SENSOR FAILURE DETECTION AND 


IDENTIFICATION FOR THE NASA F-8 DFBW AIRCRAFT 

It it 'it 

James C. Deckert, Mukund N. Desai, John J. Deyst, Jr. 

+ 

and Alan S. Willsky 


SECTION 1 
SUMMARY 

A technique is developed which provides reliable failure 
detection and identification for a dual-redundant subset of the flight 
control sensors aboard the NASA F-8 digital fly-by-wire aircraft. 

The technique is successfully applied to simulated sensor failures 
on the NASA Langley Research Center real-time F-8 digital simulator 
and to sensor failures injected on telemetry data from a test flight. 


INTRODUCTION 

With the introduction of flight critical fly-by-wire systems into 
operational aircraft and the proposed use of direct sideforce and 
lift devices in future generation aircraft, attention has been focusing 
on the development of highly reliable, fault tolerant flight control 
systems. Because of the difficulty in developing the required 
reliability in single sensors, current practice for fault tolerant 
sensor operation involves the use of voting among three or more sensors 
of the same type. Such a voting scheme with three sensors provides 
operational capability in the presence of a single failure. However 
* 
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in such a triplex voting system, the two sensors which remain following 
the identification of the failure of the third sensor provide no identi- 
fication capability for the subsequent failure of one of the remaining 
pair. Thus the third sensor in a triplex system is in essence being 
used only to vote, and provides little appreciable benefit in terms 
of performance under no-fail conditions. The attendant costs in both 
initial acquisition and subsequent maintenance of this third sensor 
of each type have motivated the study described in this report. 

In this study we have developed the methodology for a highly 

reliable single fault tolerant sensor system in which only dual 

redundancy is present, i.e., in which only two sensors of each type 

are present*. The technique in essence involves voting, but the 

third "vote" is provided by the analytic redundancy which exists in 

the functional or kinematic relationships between the variable being 

measured by the suspect sensor type and the variables being measured 

by the other sensors on the aircraft. Although sophisticated techniques 

using analytic redundancy have been developed previously (for example, 

Refs. 1-3) , it is fair to say that these methods are all at a 

relatively early stage of development, and most may be criticized for 

computational complexity greatly exceeding the constraints imposed by 

+ 

any foreseeable onboard flight computer.' 

We have developed our analytic redundancy sensor failure detection 
and identification (FDI) technique specifically for the dual redundant 
sensors on the NASA F-8 digital fly-by-wire (DFBW) aircraft, although 
its application to another aircraft with a different sensor complement 
is straightforward. Throughout the study we have tried to emphasize 
both computational simplicity and reliability. The important features 
of the technique are the following: 

1) We limit ourselves to looking for bias failures since 

a) Although descriptions of actual failure modes are not 
currently available, it is felt that biases are likely. 

b) Techniques looking for bias failures can find most 
other types of failures. 

★ 

This technique, used in conjunction with a triplex system, can 
provide operational capability following the nonsimultaneous failure 
of two sensors of the same type. 

^See Ref. 10 for a survey of failure identification techniques. 
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2) We use direct comparison between the dual sensor outputs to 
detect failures, and use analytic redundancy for identifying 
which instrument has failed. In this way, the analytic 
redundancy tests can be made more robust. 

3) In addition, we periodically initiate the analytic redundancy 
tests to identify changes which affect like instruments in 
the same way (e.g. , thermal effects on sensors mounted' in 
the same part of the aircraft) . 

4) All reasonable functional and kinematic relationships between 
a given instrument type and the other types are developed in 
order to extract the maximal amount of information available. 

The organization of the report is as follows: In Section 2, we 

describe the FDI structure consisting of time trigger or direct 
redundancy trigger followed by analytic redundancy tests. We also 
discuss the analytic decision statistic, the sequential probability 
ratio test (SPRT) . In Section 3 we develop in detail the four kinds 
of analytic redundancy used in this study: translational kinematics, 

translational dynamics, rotational kinematics and altitude kinematics. 

In Section 4 we choose a consistent set of parameters for the sensor 
FDI system. These parameters include the instrument biases which 
each analytic redundancy test is designed to identify and the time 
limits for those tests. In Section 5 we develop the quality 
sequential probability ratio test (QSPRT) , which is a form of SPRT which 
allows us to account for the worst-case effects of unmodeled errors in 
the analytic redundancy tests. In Section 6, we discuss the outer loop 
logic, the main function of which is combining the QSPRT and SPRT out- 
puts from all the analytic redundancy tests in order to identify a 
failed sensor. In Section 7 we present some representative results 
obtained using the NASA Langley Research Center real-time F-8 simulator. 
These results demonstrate the capability of the algorithm at the design 
flight condition in the presence of high turbulence and biases on un- 
failed instruments. In Section 8 we present the results of a study 
in which the analytic redundancy FDI algorithm is applied to telemetry 
data obtained during a test flight of the F-8 DFBW aircraft. The 
importance of this section is twofold: First it indicates the ease 

with which the algorithm can be tailored to new sensor information, 
and second it demonstrates the capability of the algorithm to identify 
injected failures at several flight conditions and during maneuvers. 

In Section 9 we make some concluding remarks and recommendations for 
the form of the algorithm to be coded in the onboard computer for 
flight test. 
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SECTION 2 


FDI STRUCTURE 


2 . 1 Introduction 

The FDI for a dual redundant instrument type is normally accom- 
plished in two steps. First, the failure of one instrument of the 
pair is detected by examining only the dual instrument readings. Then 
upon detection of the failure by the redundancy trigger, several 
SPRT's are initiated utilizing the direct redundancy and all possible 
analytic redundancy among the failed instrument type and the other 
instrument types. Additionally, the analytic redundancy SPRT's for 
each instrument are initiated periodically by a time trigger in order 
to identify generic instrument- failures. The identification of a 
failed instrument is accomplished via logical processing of the various 
SPRT outputs as discussed in Section 6. 

2 . 2 Redundancy Trigger 

A direct redundancy detector, called a redundancy trigger, 
operates on the moving window average of the output of instrument 1 
minus the output of instrument 2 for each instrument type. A bias 
failure magnitude (BFM) is defined for each instrument type based on 
both the a priori sensor statistics and the capabilities of the 
various analytic redundancy failure identification techniques in the 
presence of allowable errors on unfailed instruments. A threshold 
magnitude and window size are chosen for each instrument type to give 
reasonable false alarm and missed alarm probabilities, where a false 
alarm is the indication of a bias when in fact a bias of half the 
defined magnitude or larger is not present, and a missed alarm is the 
failure to detect the presence of a bias of magnitude larger than the 
defined BFM. If the redundancy trigger detects a significant mean 
in the moving window average of the output of instrument 1 minus the 
output of instrument 2, it follows that if the sign of this mean is 
positive (negative) either instrument 1 has a positive (negative) 
bias or instrument 2 has a negative (positive) bias. 
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2 . 3 The Sequential Probability Ratio Test 


As implemented in this study, the SPRT makes sequential observa- 
tions of the process y, which represents a comparison between the suspect 

* 

instrument and other unfailed instrument types . The sample from the 
process y at time t^, is called y^. The SPRT gathers enough information 
to choose between the two hypotheses: 

: At time t^, the process y is Gaussian with mean 

m, and covariance P. 

— k 

H 2 '• At time t^, the process y is Gaussian with mean 0 
and covariance P. 

where H, is the failure hypothesis and H 7 is the no-failure hypothesis. 

-L t h ^ 

The log likelihood ratio A for the k sample is defined as 


i = _ tn p^kiy 

k p(Y k |H 2 ) 


and after n samples have been taken (assuming the independence of the 
y's) , the log likelihood ratio of the n samples is given by 


u 


n 


p(Xl, . . . ,y n l H 1 ) 

P ( X i ' • - • < Y n I H 2 ) 


n 


l 

k=l 


( 2 . 1 ) 


For the case of the two hypotheses given above, the form of is 
given by 


*k = ^-Ik) Tp '\ 

and the log likelihood ratio for n samples given by Eq. (2.1) becomes 


l - Y k ) T 

k=l 2 k 


-1 

P m. 


( 2 . 2 ) 


Assuming that either or H 2 is true, the stipulation of 
incorrect classification probabilities directly yields the thresholds 
a<0 and b>0 and the following decision rule: 4 '' 5 


* 

The details of this process for the various instruments on the 
F-8 are presented in Section 3. 
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u < a 
n — 

accept 

a < u < b 
n 

take another sample 

b 1 u n 

accept Hj 


If the log likelihood ratio is between the thresholds, a choice of 
hypotheses cannot yet be made which meets the specified incorrect 
classification probabilities, and another sample must be taken. 

One attractive property of the SPRT is that it minimizes the 
average number of observations necessary to meet these probabilities. 
In addition, the SPRT is independent of the a priori probabilities of 
the two hypotheses. It is because of these properties of the SPRT 
and because of its inherent simplicity as shown in Eq. (2.2) and (2.3) 
that the SPRT was chosen as the basic identification tool for this 
study. A further simplification follows since all of the observed 
processes in this work are chosen to be scalar or the sum of scalars. 
The scalar form of Eq. (2.2) is given by 


u 


n 


n m, 

l 

k=l a 



Y k) 


(2.4) 


2 

where a is the variance of the scalar process y. Observe that if 
the mean is present in y^, the expected value 'of u^ is 


E [u 

n 


] 



n 


l 

k=l 


(- mj) 


(2.5) 


In fact any mean of y^ with the sign of m^ and greater in magnitude 

than ]m, |/2 will drive u toward the negative threshold, which by 
k n 

our definition indicates an instrument failure. Thus an individual 
SPRT may make a false identification tinless the mean m^ is chosen 
such that biases in instruments operating within tolerance have 
magnitude less than lm^l/2. 

In response to a redundancy or time trigger, several SPRT 1 s 
are begun. In the case of initiation by the redundancy trigger, 
one direct redundancy SPRT observes the difference between instrument 
1 and instrument 2 of the detected failure type, the same process 
observed by the redundancy trigger. The mean which constitutes the 
failure hypothesis, m k , has magnitude equal to the pre-defined sensor 
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BFM and has the sign of the moving window average computed by the 
trigger. This SPRT serves to corroborate the trigger concerning the 
presence of a bias between the two instruments. Additionally, one 
SPRT for each instrument of the failed type is begun for every kind 
of analytic redundancy available. Detailed descriptions of these 
tests are given in the next section. The underlying basis for the 
analytic redundancy SPRT's is the comparison of the measurement of 
a variable obtained using the suspect instrument and another measure- 
ment of the same variable obtained using other instrument types. The 
difference in these measurements forms the residual y^ which is the 
input to the SPRT. The mean for each SPRT, m^, is calculated to be 
consistent with the predefined sensor BFM and the failure sign informa- 
tion from the redundancy trigger. 


2 . 4 Time Trigger 

On initiation by the time trigger for a particular instrument 

type, one SPRT for each sensor is begun for every kind of analytic 

redundancy for which the mean (the failure signature) is observable 

following the failure. Thus there are some instrument types, e.g., 

* 

the yaw attitude gyro, for which time triggers are not possible . 

Since there is no direct comparison of instruments for a time 
trigger, failure sign information is not available in this case, and a 
failure of either sign is possible for each instrument. A failure of 
either sign is identified by a single SPRT for an individual instrument 
as follows: Eq. (2.4) is rewritten as 


u 


n 


1 

a 


n 


l 

k=l 



n 


I 

k=l 


m k Y k 


( 2 . 6 ) 


The mean m^ is chosen to be consistent with a positive instrument 
failure with magnitude equal to the BFM. Then the SPRT output is 
defined to be 


1 


n 


-5- ! I m k Y k I 

k=l k=l k K 


(2.7) 


The reasons for this are clarified in Section 3. 
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If u n crosses the negative threshold, a failure is indicated, and the 
sign of the failure is the sign of the sura whose absolute value is 
used in Eg. (2.7). 


Failure Identif ication by the Outer Lope 


Because most instrument types have more than one form of 
analytic redundancy available for use in FDI, it is not practical 
for the failure identification process to be performed by the individual 
SPRT's via Eq. (2.3) for the different forms of analytic redundancy* 
Instead an outer loop observes the outputs u n (or u n for a time trigger) 
from all of the SPRT's running for the triggered instrument type. 

Since the different forms of analytic redundancy have different 
error sources, many of them dependent upon flight condition and 
maneuver activity, it is necessary that the outer loop have some 
measure of the goodness or quality of each form of analytic redundancy 
test at each point in time. This measure is provided by a quality SPRT 
(QSPRT) for each form of analytic redundancy associated with 
the suspect instrument type. Thus in response to a time or redundancy 
trigger for a particular instrument type, a QSPRT for each form of 
analytic redundancy is calculated in addition to the SPRT's for the 
individual instruments. The outputs of these QSPRT ' s and the outputs 
of the SPRT's associated with individual instruments are then 


combined by the outer loop to perform failure identification. The 
details of the outer loop are given in Section 6, while the details 
of the QSPRT ' s are given in Section 5. 
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SECTION 3 


ANALYTIC REDUNDANCY SPRT ' s 


3 . 1 Introduction 

The dual redundant instrument types which are available on the 

* 

F-8-DFBW aircraft are the following: longitudinal accelerometer, 

lateral accelerometer, normal accelerometer, roll rate gyro, pitch 
rate gyro, yaw rate gyro, vertical gyro, directional gyro, altimeter, 

Mach meter and alpha vane. In addition, a nonredundant beta vane is 
available. Each vertical gyro gives an indication of pitch angle 6 
and roll angle <fi . Table I indicates the white noise and quantization 
levels assumed in this study for the various sensors. Also shown are 
the RSS bias magnitudes for unfailed sensors, where known. In this 
report only the failures of the dual redundant instrument types are 
addressed, and failures of the indication of 0 and <j> for each vertical 
gyro are considered to be independent. The consideration of simultaneous 
failures of both of these measurements is discussed in Appendix D. 

Four types of analytic redundancy are utilized in this study: 
Translational kinematics redundancy exists between the integrated 
output of the accelerometers, vertical gyros and rate gyros and the 
outputs of the air data sensors, i.e., the Mach meter, altimeter and 
alpha and beta vanes. Translational dynamics redundancy relates the 
aerodynamic forces on the aircraft measured by the accelerometers 
and the calculated aerodynamic forces based on the air data sensors 
through stored aerodynamic coefficients. Rotational kinematics 
redundancy relates the integrated outputs of the rate gyros and the 
outputs of the vertical and directional gyros. Altitude kinematics 
redundancy exists between the altitude given by the altimeter 
outputs and the altitude computed as the double-integral of the 
accelerometer and vertical gyro outputs. 

In the following subsections, these four types of analytic 
redundancy and t he SPRT ' s exploiting them will be discussed in detail. 

*Although triple redundancy exists for the accelerometers and rate 
gyros, this added redundancy will not be assumed here. 
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Table I Sensor Information 


SENSOR 

TYPE 

SIGMA 

QUANTIZATION 

RSS 

UNFAILED 

BIASES 

Mach 

.01 

.0056 

— 

a (rad) 

. 01 

. 00017 

— 

a (m/s 2 ) 
X , 2 

.3 

.011 

.46 

a (m/s ) 

•3 

.011 

.46 

a z (m/s ) 

.3 

.054 

.46 

p (rad/ s ) 

. 0024 

.0024 

. 01 

q (rad/s) 

.0007 

.0007 

.003 

r (rad/s) 

.0007 

. 0007 

. 003 

<j> (rad) 

.01 

.0015 

— 

6 (rad) 

.01 

.0015 

— 

ip (rad) 

.01 

.0015 

— 

B (rad) 

.01 

.00017 

— 

h (m) 

3.05 

3.4 

— 


The SPRT's will be formulated assuming initiation by the direct 
redundancy trigger. Modifications of these tests in the case of 
initiation by the time trigger are straightforward, and follow the 
discussion in Section 2. 

3 . 2 Translational Kinematics 

The translational kinematics SPRT's utilize the redundant 
information concerning the translational motion of the aircraft. The 
body mounted linear accelerometers measure the body axis components 
of the non-gravitational contribution to the acceleration of the 
aircraft with respect to inertial space. The measured velocity, V , 
is the noisy measurement of the velocity V of the aircraft with 
respect to the air mass expressed in body axes. This air-relative 
velocity vector is a function of Mach numbers//, angle of attack a, 
sideslip angle 0, and the speed of sound V , which is itself a function 
of the altitude h: 
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V 


cos 8 cos a 
sin 8 

cos B sin a 


v s (hX^ST 


(3.1) 


The differential equation for the air-relative velocity in body 
coordinates is given by 


= - F + g 

m — — 


- $) V - £ 


(3.2) 


where m is the aircraft mass, F is the aerodynamic force on the air- 
craft and j is the gravity vector. The matrix (2 is the skew-symmetric 
cross-product matrix: 


0 


0 , 


r 


-q 


-r 

0 

P 


q 

-p 

o 


(3.3) 


where p, q, and r are the roll rate, pitch rate and yaw rate respectively. 
The vector is the acceleration of the air mass with respect to 
inertial space. Assuming that the accelerometers are located at the 
same position R relative to the center of mass, the vector A composed 
of the outputs of ideal x, y and z accelerometers is related to the 
aerodynamic force via 


a = - f + [a 2 + n]R 

— m — — 


(3.4) 


The compensated ideal accelerometer output vector A' is defined as 

.2 


A 1 = A - [n + Q] R 
Equations (3.2), (3.4) and (3.5) yield 

v = A’+g-nv-C 


(3.5) 


(3.6) 


The translational kinematics SPRT ' s utilize the following 
discrete approximation to Eq. (3.6) to propagate the air-relative 
velocity estimate V ahead one time step, where T = (t - t n _^) : 


V'(t ) = V(t ,) + IV + C g - tiV }T 

— n — n— 1 — m — m m—m 


(3.7) 
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The measured air-relative velocity is incorporated into the estimate 
via 


where 


V(t n ) = V' (t n ) + k Y(t n ) 

= W - 


(3.8) 


(3.9) 


The inputs to the translational kinematics SPRT's are the components 
of the measurement residual vector y(t ) . In Eq. (3.7) a bar over a 
variable indicates that it is averaged over the interval (t ^,t ), 
an m subscript indicates a measured quantity, and the prime on 
V' (t ) indicates that it is the propagated estimate not including the 
present measurement. The vector indicates the average of the 
compensated accelerometer outputs at t R and t n _^. The compensation 
equation given by Eq. (3.5) is utilized, with the S2 terms obtained 
as the differences of the respective rate gyro outputs at times t 
and t divided by the time step, and the fi terms being the averages 
of those rate gyro outputs. The local vertical vector is obtained using 
the average of the vertical gyro measurements of <j> and 8 over the interval: 


C 


— m 


- sin 9 

m 

cos W sin 
m 

cos W cos 
m 



(3.10) 


The matrix uses the averages of the rate gyro outputs. It is also 
used in the accelerometer compensation equations. The vector in 
Eq. (3.7) likewise denotes the measured air-relative velocity based 
on the average of the air data sensor outputs at time t n and t ^ . 

There are three important aspects of the form of Eq. (3.7): 

1. The term in braces indicates an estimate of the air- 

relative acceleration of the aircraft at the midpoint of 
the propagation interval, and the resulting integration 
rule is good to approximately second order. This second 
order integration rule is used to ensure accurate filter 
performance during high rotation rate or acceleration 
maneuvers . 
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2. 


The average measured velocity is used in the right hand 
side of Eq. (3.7). Although the standard form of the 
extended Kalman filter for this system 6 would employ the 

A 

estimate V, we have chosen to use the average measured 
velocity derived from air data to decouple the three 

A 

components of V. This decoupling allows the use of scalar 
SPRT's which will be discussed presently. 

3. There is no term in Eg. (3.7) corresponding to the accelera- 
tion of the air mass, £. Since the effect of a constant 
value of £ , i.e., wind shear, is indistinguishable from 
the effect of an accelerometer bias on the residual process 
y, our interpretation of a nonzero component of y must 
account for the possibility of wind shear. This idea will 
be expanded upon shortly. 

Assuming that we are interested in identifying bias errors in 
the sensors, it is clear from Eq. (3.7) that at least three types of 
sensor biases will appear as acceleration errors in the propagation 
equation for V: 

1. Accelerometer biases through A' 

— m 

2. Vertical gyro biases through 

3. Rate gyro biases through fi V 

m — m 

Thus translational kinematics SPRT's are started when the failure of 

an accelerometer, vertical gyro or rate gyro is detected by the 

trigger. In order to avoid the transient effects of air data sensor 

noise, one set of Eq. (3.7) through (3.9) is always running to 

* 

provide the initial velocity estimates for the SPRT's, The structures 
of the SPRT's for all of these instrument types are analogous. Two 
versions of the filter given by Eq. (3.7) through (3.9) are implemented, 
one version using the output of the number 1 instrument of the 
detected failure type, plus all the necessary measurements from the 
other instrument types, and the other version using the same informa- 
tion with the exception that it uses the output of the number 2 
instrument of the detected failure type. The residual process y from 
the filter using a particular instrument is the input process sampled 


Good results have been obtained with k chosen to give a discrete 
approximation to a continuous filter with a 1/2 second time constant. 
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by the SPRT looking for the effect of a bias in the same instrument. 

The expected error in acceleration used in the SPRT varies at each 
sample and is obtained from Eq. (3.7) using the predefined sensor bias 
size and the sign of the difference between instruments 1 and 2 as 
given by the redundancy trigger. 

In order to decrease identification times and minimize computa- 
tional complexity, the translational kinematics SPRT ’ s use a zero 
value for the gain k in Eq. (3.8). Thus the time-varying mean m^ for 
each SPRT is simply incremented at each sample by the expected 
velocity error using the assumed sensor bias failure via Eq. (3.7). 

For the case of a constant vehicle state and a sensor bias error, 
the means for the two SPRT ' s are of opposite sign and grow in magni- 
tude linearly with time. We note that for an accelerometer bias, the 
resulting velocity error shows up only in the corresponding residual 
component, allowing the implementation of scalar SPRT's. For rate 
gyro failures, the corresponding acceleration bias, arising from the 
V term, leads to a velocity error essentially in one component. 

This is exact when a and 8 are zero, and the unidirectional assumption 
is justified for reasonable angles of attack and sideslip. Hence we 
can also implement scalar SPRT's in this case. 

Examination of Eq. (3.7) is instructive for determining the 
sizes of biases in the various instruments which can be identified 
with this technique. Recall that it is highly unlikely that a mean 
will be indicated by the SPRT if the actual mean present in the 
process is less than half the mean of the test. Thus, the sum of 
the acceleration errors due to the acceptable biases in all other 
instruments used in Eq. (3.7) must be less than half the SPRT mean for 
the instrument type being checked, or a false identification may be 
made. By carefully setting the BFM's for the various instruments in 
all SPRT's in a consistent manner, the problem of false identification 
from undetected sensor biases can be minimized. This selection process 
is detailed in Section 4. 

The remaining factor which can contribute to false identifica- 
tion in the translational kinematics SPRT's is wind shear. Simulations 

O 

at Mach 0.6 at 6100 m altitude with a modified Dryden wind model 

using a 99% sigma value of 5.5 m/sec and a correlation length of 

2 

533 m have produced wind shears of 3 m/sec which persist for as 
long as 6 seconds. A simple approach to removing the effect of this 
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wind shear in turbulence involves limiting the SPRT gain (formerly 
2 

m k /a ) . The parameters of the SPRT gain can be made a function of 
the turbulence level as reflected by the variance of the residuals in 
the continuously running initialization filter. In this way, the 
slower response due to SPRT modification can be avoided in the absence 
of turbulence. The implementation of this clipped SPRT gain is 
discussed in Section 4, while the turbulence estimator is discussed 
in Appendix A. 

3 . 3 Translational Dynamics 

The translational dynamics SPRT's utilize the redundant informa- 
tion related to the aerodynamic forces on the aircraft. The accelero- 
meters measure these aerodynamic forces together with the lever arm 
forces arising from the fact that the instruments are not located at 
the vehicle center of mass. In particular A’, the vector of ideal 
x, y, and z accelerometer outputs corrected for lever arm effects, is 
related to the vector of aerodynamic forces on the vehicle, F, via 

A' = - F (3.11) 

— m — 


F may be written as 


F 


F-Dcosa+Lsina 

e 

Y 

- D sin a - L cos a 


(3.12) 


with L the lift, D the drag, Y the sideforce and F g the engine thrust. 

If the aircraft has no flap, leading edge or speedbrake extensions, 
the lift, drag and sideforce are given by 


L = C L qS 

D = ( c d + C D<5e^ qS 
Y = (c ye B + Vr 5r + C y6a 5a)qS 


(3.13) 


where the sideforce equation neglects small terms due to roll and yaw 
rates. In Eq. (3.13), S is the wing area, q the dynamic pressure; and 6 , 
6 , 6 are the rudder, aileron and elevator positions respectively. The 
aerodynamic coefficients in Eq. (3.13) have been determined experimentally 
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and are tabulated as functions of Mach, angle of attack and elevator 
position. In addition, thrust has been tabulated as a function of 
air-relative velocity, altitude and throttle position. By utilizing 
these tables, or functional approximations to these tables, expected 
accelerometer outputs can be calculated based on the air data sensors, 
providing analytic redundancy. 

The translational dynamics SPRT's are used to identify failures 

* 

in the accelerometers, alpha vanes and Mach meters . After detection 
by the redundancy trigger of an accelerometer failure the calculation 
of two SPRT's is begun, one for each of the accelerometers of the 
detected failure type. The input to each SPRT is the respective 
compensated accelerometer output minus the expected accelerometer output 
based on the air data measurements. As in the case of the translational 
kinematics SPRT's these calculations are made for the midpoint of the 
sample interval using average sensor outputs. Each SPRT mean is cal- 
culated using the predefined accelerometer BFM and the sign information 
from the redundancy trigger. These mean calculations are performed 
only when the SPRT's are started and are held constant thereafter. 

For the case of an alpha vane or Mach meter detected failure, 
the procedure is analagous to that outlined above though somewhat 
more complicated. Two SPRT's are calculated, each using identical air 
data output, except for the detected failure type, to compute the 
expected lift and drag on the vehicle. Each of the two SPRT’s uses 
a different member of the pair of instruments for which a failure has 
been detected to make these calculations. The expected compensated 
x and z accelerometer outputs using these two sets of air data sensors 
are then computed using Eq. (3.11) through (3.13). These two sets 
of expected compensated x and z accelerometer outputs are then used to 
calculate the x and z acceleration gradients with respect to the 
detected failure type. Then the x and z means for the two SPRT's 
are calculated using the computed gradients, the predefined alpha or 
Mach bias and the sign information from the redundancy trigger. The 
input to each SPRT consists of a two-dimensional vector of the expected 
minus the actual x and z accelerometer output. The noises in the two 
components of this vector are assumed to be uncorrelated with equal 


* 

Recall, since we have only a single 6-vane, we have not considered 
FDI for this instrument. 
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2 

variance a to facilitate computation. To be specific, assume that 
an alpha vane failure has been detected by the redundancy trigger. 
Using alpha vane 1 and the other air data sensor types, expected 
compensated x and z accelerometer outputs a . and a n are calculated 

X / -L Z , -L 

via Eg. (3.11) through (3.13), with expected outputs a 9 and a _ 
calculated using alpha vane 2 and the same set of other air data. 
Assuming that the predefined alpha vane BFM is b^ and the sign of 
(“l - a 2 ) s a f roin the redundancy trigger, the means for the SPRT 
using alpha vane 1 are 


a . - a „ 

n , = b s 

x,l - a 2 a a 


LI 

Z ,1 


a . - a „ 
z , 1 z , 2 


b s 

a.2 a a 


while the means for the SPRT using alpha vane 2 are 


(3.14) 


11 n 
x , 2 


= - m 


x,l 


u ~ 

z , 2 


= - m 


2,1 


(3.15) 


With the actual compensated accelerometer outputs given by A^ and A^ , 
the SPRT variable u for alpha vane 1 is incremented by 


Au. 


" m - m ") 

= ( 3 V - - a . + A ' ) m . + - a . + A')m . 

'•2 x,l x-'x,! '•2 z,l z' z,lj 


/o 


while the increment for the SPRT using alpha vane 2 is 


Au- 


-[< 


x , 2 


-a _ + A ’ ) m _ + f- 
x , 2 x J x,2 


II » 

z ,2 


- a z , 2 + 


^z) m z , 2^ 


/v c 


The means given by Eg. (3.14) and (3.15) are calculated at each sample 
using sensor outputs averaged over the interval. 


The two major sources of error in the translational dynamics 
SPRT's involve the aerodynamic coefficients in Eg. (3.13). One error 
is the difference between the functional approximations to the 
coefficients, used in the flight computer, and the tabulated values 
of the coefficients. The impact of this error source is minimized 
by the proper choice of fitting functions and by forcing the best fits 
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in the most common flight regimes. When the aircraft is flying out- 
side the region of good fit, appropriate increases are made in the 
worst case bias error used to calculate the QSPRT for translational 
dynamics. The fitting functions for the aerodynamic coefficients, and 
the attendant worst-case errors, are discussed in Appendix B. 

The second error source is the difference between the tabulated 
aerodynamic coefficients, which reflect our a priori knowledge, and 
the true coefficients for the aircraft. It is felt that the tabulated 
coefficients have the correct shape, but may be biased due to 
external stores, geometry differences from nominal for an individual 
aircraft, etc. The magnitude of any such biases and their effects 
on the translational dynamics SPRT’s await analysis of flight test data. 

3 . 4 Rotational Kinematics 

3.4.1 Introduction 

In this section, we consider failure identification for the 
angular sensors, the rate gyros and attitude gyros, using the kine- 
matic relationship between the angular rate and the attitude of the 
aircraft. 

The body mounted rate gyros provide noisy measurements p , q , 

r m of the rigid body rates p, q, r about the longitudinal, lateral 

and normal body axes, respectively. The attitude sensors, directional 

and vertical gyros, provide the measurements il / , 0 , d> of the Euler 

m m m 

angles if) , 0, <j> which define the orientation of the body axes with 
respect to the navigation frame. The order of the three rotations 
involved in going from the navigation frame to the body frame is 
yaw ( ip ) , pitch (0), and roll (<j>) . 

The rigid body rates p, q and r are related to the Euler angles 
and their rates via the relationships^ 

p = g-ijisinQ 

q = 0 cos <t> + ii cos 0 sin g (3.16) 

r = - 0 sin <)> + i cos 6 cos <f> 

The inverse relationships expressing the Euler angle rates in terms 
of the rigid body rates can be obtained from the above equations to 
yield : 
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(3.17) 


$ 

= p 

+ q 

sin <p 

tan 

0 + r 

cos <p 

tan 9 

e 

= q 

cos 

ip ~ r 

sin 

<f> 



* 

= q 

sin 

ip sec 

0 + 

r cos 

(j> sec 

0 


Equations (3.17) are not convenient to use to obtain the Euler angle 
rates from the rigid body rates because of the singularities at' 

9 = ± tv/2 . Alternate approaches which avoid this singularity involve 
the differential relationships between elements of the direction 
cosine matrix or attitude quaternion and the rigid body rotation rates. 
However, the attendant computational complexity of these approaches 
may be avoided for the purpose of failure identification by the 
following set of equations (easily derived from Eq. (3.16) and (3.17)) 
which also avoids the singularity: 

| = p + $ sin 9 

0 = q cos <p - r sin <j> (3.18) 

iji = ( 4> - p) sin 0 + (q sin (}> + r cos <J> ) cos 0 

The form of kinematic relations (3.16) and (3.18) is well suited to 
failure identification of the rate gyros and the attitude gyros in 
that the derivative of a variable is not written as a function of the 
variable itself. 


3.4.2 Attitude Sensor Failures 

Utilization of the rotational kinematics for failure identifica- 
tion of the attitude sensors is illustrated here by a detailed consider- 
ation of the roll attitude sensor. The other sensors can be considered 
in a similar fashion. 


The predicted change in the roll angle over a time interval 


(t n _ 1 ,t n ) can be obtained using a discrete approximation of Eq. 




'^n-l* + Pm T+ IW 


ip (t . ) ] sin 0 
Y m n-1 m 


(3.18) 

(3.19) 


where average measurements are used as before to minimize filter 
errors. The comparison of the measured roll angle and the predicted 
roll angle <)> ’ yields the residual 
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vv 


(3.20) 


= <j> (t ) - <j> ’ (t ) 

T m n Y n 

The residual y^ is used to update the estimate $ via 

i(t n ) = <f>'(t n ) + k y^(t n ) (3.21) 

where k represents a suitably chosen filter gain. 

Equations (3.19) through (3.21) represent the roll filter. The 
pitch and yaw filter equations may be similarly obtained using 
Eq. (3.18). As in the translational kinematics filters, these 
rotational filters have been simplified in form to minimize computa- 
tional complexity and to limit each failure signature to a single 
channel. This decoupling of the roll, pitch and yaw channels is 
accomplished by using measurements, rather than estimates, of the 
Euler angles and body rates in the propagation equations (e.g., Eq. (3.19)). 

As in the translational kinematics case, a conflict exists between 
the desire for noise suppression in normal operation and the desire 
for large, observable failure signatures. The conflict was resolved 
in that case by using a single filter with appropriate nonzero gain k 
to initialize, after failure detection by the trigger, the two k=0 
filters used by the SPRT's for failure identification. A similar 
implementation of Eq. (3.19) through (3.21) for failure identification 
of the attitude sensors will now be presented. 

A nonzero value of k is chosen in Eq. (3.21) to give good filter 
performance in the absence of failures by minimizing the effects of 

•k 

allowable noise on unfailed instruments . Two versions of the 
equations are implemented, each using a different roll attitude sensor 
to give <J> m . Each filter stores the last N residuals y^ from Eq. (3.20). 

The signature of an attitude sensor bias in the residual decays 
exponentially at a rate proportional to the gain k, making it difficult 
to identify in the presence of noise. However, if the gain k is zero, 
the sensor bias failure signature is a step in the residual. This 
step persists in time, enhancing its identification. Therefore, at 
the time a roll attitude gyro failure is detected, calculations are 
made which effectively set k=0 for the two filters commencing N 
samples prior to the detection time. This is accomplished by using 


* 

The same value of k as for the translational kinematics filters 
has given good results. 


26 



the stored k^O residuals via the relation 

t 1 

Y k =0 (t n ) = ^0 ( V + k l Y k^0 (T) 

T d-N 

where t, denotes the failure detection time. The k=0 residuals for 
d 

each filter are the input to an SPRT looking for a bias in the filter's 

roll attitude gyro, where each SPRT mean has the predefined roll BFM 

* 

and sign consistent with the output of the redundancy trigger . 

Pairs of uncoupled filters similar to Eq. (3.19) through (3.21) 
are implemented for the pitch and yaw attitude sensors, and failure 
detection and identification for these sensors are accomplished in a 
manner identical to that described above for the roll attitude sensors. 

The primary error sources in the k=0 residuals given by 
Eq. (3.19) through (3.21) are the acceptable biases on unfailed rate 
gyros and the uncertainty in the orientation of the axes about which 
the body rates and Euler angle rates are measured. This axis 
uncertainty can arise from such factors as mounting errors, structural 
bending and attitude sensor errors. The effects of these error 
sources are accounted for explicitly in the QSPRT ' s for the rotational 
kinematics tests for attitude gyros. 


3.4.3 Attitude Rate Sensor Failures 

As was done for attitude sensor failures, failure identification 
for the attitude rate sensors will be illustrated by considering only 
one instrument, the roll rate gyro. Analogous procedures are followed 
for the pitch and yaw rate gyros. 

The predicted roll rate p'(t n ) at the midpoint of the interval 

(t ,,t ) is related to the attitude sensor measurements by the 
n— 1 n 

discrete approximation to the first relation of Eq. (3.16): 


p'(t n ) T = (VV - 


J>m (t n-i )] 


[ W - ’V t n-l )]sin 


0 (3,22) 

m 


* 

Note that if there are significantly more than N samples between the 
onset of the attitude sensor bias and its detection by the redundancy 
trigger, the failed instrument cannot be identified by this test. 

Thus it is impractical to use rotational dynamics tests following 
a time trigger for an attitude instrument. 
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and the residual between the measured motion and the predicted motion 
is given by 


W = [ P m - p ' (t n )lT (3 - 23) 

where again the overbar indicates a quantity averaged over the time 

interval. In order to minimize the effects of attitude measurement 

noise in the effective differentiation in Eq. (3.22), the residual 

y is defined as 
P 

t 

n 

W = E V T) (3 - 24) 

^ T“t. P 

a 

where t^ is the time of roll rate gyro failure detection by the 
redundancy trigger. Since the summation operation in Eq. (3.24) follows 
the differencing in Eq. (3.22), the use of Yp for failure identifica- 
tion removes the undesirable noise correlation in successive samples 

of y . Two residual processes y are formed after roll rate gyro 
P P 

failure detection, each one using a different roll rate gyro measure- 
ment. Each process Yp constitutes the input to an SPRT looking for 
the effect of a bias failure in the corresponding roll rate gyro. 

The mean of each SPRT starts at zero and is incremented at each sample 
by a quantity whose magnitude is the predefined roll rate gyro BFM 
multiplied by the time step and whose sign is consistent with the 
output of the redundancy trigger. 

The primary error source in failure identification for the 
attitude rate gyros via Eq. (3.22) through (3.24) and their analogues 
for the pitch and yaw rate gyros is Euler angle bias. This bias can 
arise from the acceptable biases on unfailed instruments or from axis 
misalignment, and its effect, which is proportional to vehicle 
maneuver rate, is accounted for in the appropriate QSPRT. 

3 . 5 Altitude Kinematics 

The altitude kinematics SPRT utilizes the differential relationship 

h = a 

v 
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where h is the altitude and a v the inertial vertical acceleration of 
the aircraft. The vertical acceleration can be estimated using the 
relationship 


a = a sin 6 - a sin <t> cos 6 

v,m x,m m y,m y m m 


- a cos d> cos 8 - g 

z ,m T m m ^ 


(3.25) 


where a , a and a represent the lever arm compensated outputs of 
x f m y t in z f rn 

the body mounted accelerometers and tp and 0 are the outputs of the 

mm 

roll and pitch attitude gyros, respectively. 


From Eq. (3.25), it may be noted that the error in the derived 

acceleration, a , due to a bias in one of the accelerometers depends 
v f Tn 

upon the orientation of the accelerometer input axis with respect to 
the vertical, whereas the effect of a bias in the pitch or roll 
attitude gyros depends upon the orientation of the vehicle as well 
as the magnitude of the vehicle acceleration components. Thus, the 
altitude kinematics relationship is normally suited for FDI for the 
altimeter and normal accelerometer. The relationship is unsuitable 
for FDI for the remaining instruments, x and y accelerometers and 
the roll and pitch attitude gyros, except during maneuvers involving 
large attitude excursions and accelerations. 


As in the case of other kinematic SPRT ' s considered earlier, the 
modes of processing the altimeter outputs and the derived vertical 
acceleration are different during the times of normal operation and 
when the fault isolation of one of the failed instruments is needed. 


During the normal operation, the measurements are processed 
by two non-zero gain (k^O) filters for the estimates h 1 and v 1 , i=l,2, 
as follows: 

* i(t n + l> = + ;±(t n )T + *v,m T '/ 2 + (3 ’ 26) 


vl ( t n+l ) = vl(t n> + a w.m T + 


n' v,m A 1 2 1 ' n+1 


(3.27) 


where the residual an< ^ t ' le average vertical acceleration 


a are defined as 
v ,m 
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(3.28) 


Y 1 (t ) = h^(t ,.) - {h 1 (t ) + v 1 (t ) T + a T 2 /2 ) 
n+l m n+i n n v,m 

. 2 

a = x I (a 1 (t ) + a 1 (t . ) } 

v,m 4 , L . v,m n v,m n+l 

i=l 


(3.29) 


i th 

In Eq. (3.28) and (3.29), represents the i altimeter output, and 
a^. represents the vertical acceleration derived using the i tkl set of 
accelerometers and the attitude gyros. The gain is selected to be equal 
to /2k 2 T, based on the optimal Kalman filter for a double integral plant 

•k 

with T the sample period . The selection of the value of the other gain 
k 2 , which determines the bandwidth of the filter, is based on consider- 
ations discussed in detail in Appendix E. 


At the time of failure detection, the effect of the failure on 
the filter residuals is enhanced effectively by starting two zero-gain 
(k=0) filters (one for each instrument) with initialization being 
provided by the kj^O filters. The considerations in the mechanics 
of initialization are different in the case of altimeters versus 
the accelerometers and the attitude gyros, as discussed below. 

In the case of altimeters, the two k=0 filters are started N 
samples prior to the time of failure detection for reasons similar 
to those for attitude, sensor failure isolation using the rotational 
kinematics SPRT. This is effectively accomplished by storing the 
last N samples of the k^O filter residuals and calculating the 
residuals for the two k=0 filters as follows: 


Y k=0 (t n+1 ) Y M0 (t n+l ) + £ h (t n ) + £ v (t n )T 


4‘W = e h (t n ) + T + k lio (t n + l> 


(3.30) 

(3.31) 


e 1 (t 
v 


n+l 


£ v ( V + k 2 Y M0 (t n+l ) 


(3.32) 


where i=l,2. In Eq. ('3.30) through (3.32), and e 1 represent 

t h ^ v 

respectively the differences between the i k^O and k=0 filter 

altitude and velocity estimates. The computations of Yj^_g residuals 

are started at t d _ N » N samples prior to the detection of a failure at 

time t. with initial conditions 
d 


★ 

This value of gain for the optimal filter gives a filter damping ratio 
of .707 
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0 


(3.33) 


£ h (t d-N ) 




In the case of accelerometers and attitude gyros, the two k=0 
filters are started at the time of failure detection. The filter 
equations are as follows 


to (t n + l> 

■ io'v '♦ vo<v t ♦ 

(t _ ) + S 1 (t ) >T 2 /4 
n+1 v,m n 

(3.34) 

V k=0 (t n+1 } 

v k=0 (t n J + 2 ^v.m^n+l 1 

+ S v,m (t n )}T 

(3.35) 

Y k=0 (t n+l } 

- j * h X + i> J ■ 

h k=0 (t n+l } 

(3.36) 

initial conditions given by 




io (t d> = 1 i. ^ <v 


(3.37) 


3=1 




V k=0 (t d } = 2 £ (t d 5 


(3.38) 


In Eq. (3.35), a 1 represents the derived vertical acceleration usinq 
th v ' m 

the i sensor of the failed pair of instruments and the average of 
the pairs of unfailed instruments. 


The k=0 residuals for each filter are input to an SPRT 
looking for the effects of a bias failure in the particular sensor of 
the failed pair used in the filter. The SPRT mean is defined as the 
signature in the residual of a sensor bias with magnitude equal to 
the predefined value and sign consistent with the output of the 
redundancy trigger. 

The primary noise sources in the k=0 filter residuals are 


1. The error in the initialization of the velocity estimate 
of the filter (see Eq. (3.38)). 

2. The presence of acceptable biases on the unfailed 
instruments used in the filter. 


Choice of an appropriate bandwidth for the k^O filters is required 
to keep small the effect of the altimeter noise and the instrument 
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bias on the initial velocity estimates. For example, decreasing the 
bandwidth of the filter (i.e., smaller gains) leads to reduced errors 
in the velocity estimate due to altimeter noise but leads to increased 
errors due to the effect of biases in the accelerometers and the 
attitude gyros. The trade-off choice of the filter gains can be based 
on the knowledge of the altimeter noise statistics and the magnitude 
of the allowable biases in the unfailed instruments. Thus far, a 
choice of 1<2 numerically equal to the gain used in the translational 
and rotational kinematics filters has worked well. 
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SECTION 4 


CALCULATION OF FDI SYSTEM PARAMETERS 


4 . 1 Introduction 

As we have seen, each instrument type enters into the calcula- 
tions for several SPRT's, either as the suspect instrument being 
examined for possible failure or as one of the other instruments being 
used in the SPRT (or QSPRT) calculations. Thus, the BFM ' s for the 
various instruments are all interrelated, and their calculations must 
be considered together. Additionally, although the theory indicates 
that the various SPRT's will eventually reach a decision by crossing 
a threshold, it is clearly undesirable to allow the running time of 
these tests to be unbounded, and each analytic redundancy SPRT must 
have associated with it an elapsed time limit (ETL) . In this 
section we describe a methodology whereby a consistent set of BFM ' s 
and ETL's are calculated for the various dual-redundant sensors aboard 
the aircraft. This methodology is conservative, as we have chosen to 
design the system to work under "worst-case" conditions. We will 
consider the various instrument types one or two at a time, indicating 
the various worst-case assumptions and any tradeoffs that may arise. 
The underlying philosophy of our approach will become clear to the 
reader as he examines these calculations. We note here that when the 
BFM and ETL calculations depend upon the aircraft state, trim condi- 
tions at Mach=0.6 and h=6100 m are used. The full state-dependent 
terms are used in the calculation of the QSPRT' s, however, as 
discussed in Section 5. 

4 . 2 Rate Gyros 
4.2.1 Roll, p 

Recall the defining equations for the roll rate gyro transla- 
tional kinematics SPRT given by Eq. (3.22) through (3.24), where 
we set 
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T = (t - t , ) = .0625 sec 

n n— ± 

and for simplicity we define the detection time to be zero. 


Examining these equations, we make the following observations: 

1. If a bias failure of magnitude B develops in p m , the 

effect on the residual y p (tj) is BjT. Thus, it follows 
from Eq. (2.4) that if the BFM of p is B, the SPRT 
output is of the form 


vv> 


(4.1) 


2. To determine a, we note that y (t ) is essentially 

p n 


fc n fc n 


U e m (t)dt - W + K (0) + L * m (t) sin 9 m (t)dt 


Physical constraints limit the size of iji, and thus the 

dominant noise in this residual comes from the measurements 

2 

of <(> . Thus we set a equal to twice the variance in our 
measurement of <j> , or from Table I 


ct 2 = 0.0002 rad 2 


3. We now want to take into account any unmodeled effects that 
might cause difficulties in the test. Examining the form of 
y, we see that we can regard 4> ( 0 ) as an initialization 
for the integration of p to yield the present value of <p . 
Thus, any initialization error in <j>(0) will bias the test, 
and we assume a worst case bias on y of twice the standard 
deviation of the measurement of 4> 


b = 0.02 rad 
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4. We choose a value for the BFM equal to twice the RSS 
unfailed bias in the roll rate gyro 

B = 0.02 rad/sec 


5. We now note that conditioned on the presence of a failure 
of BFM size and of a worst case initialization bias in the 
direction opposite to the failure (making the failure more 
difficult to identify) , we have 


E[u n ] 


l 

j=0 


BjT 

2 

a 


BjT 


+ b] 


2 3 2 

B t J Bbt^ 

E + E 

2 2 
6a T 2a T 


(4.2) 


where we have approximated the summations by integrals. 

We note that as a function of t , E[u ] is first driven in 

n n 

the positive direction by the initialization bias (leading 
to the possibility of a missed detection) but that sub- 
sequently the failure term dominates, driving the 
expectation toward the negative threshold. Using thresholds 
of magnitude 9.2, corresponding to false alarm and missed 
alarm probabilities of 0.0001^ , we have the following 
equation for the time T c at which the negative threshold 
is crossed by E[u n ) 


2 3 2 

B T BbT 
c_ _ c_ 

6o 2 T 2o 2 T 


0 


Using the parameters given earlier, we find 

T = 3.2 sec 

c 


6. From the form of the SPRT in Eq. (4.1), we see that for any 
failure of size larger than B/2 , E[u n J will eventually 
go negative. As we have seen, we need about 3.2 seconds 
to detect a failure of size B=0.02, and clearly this time 
will increase as we decrease the size of the actual failure. 
On the other hand, the size of the failure we can detect for 
p will impact our ability to detect <j> failures, since we 
must use the p sensors in the SPRT for <p . We have adopted 
the following philosophy: in all SPRT's, the measured 

values for all variables other than the suspect instrument 
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type will be obtained by averaging the values from the two 
instruments of the given type. In computing the design 
parameters for this test we will assume an undetected bias 
in the measured values for the unfailed instruments to be 
1/2 the corresponding BFM. Considering this undetected 
bias to be the RSS of the biases in the two instruments 
being averaged, we see that we need to be able to detect a 
bias on the order of BF.M//2 . 

Returning to Eq. (4.1), let us assume that y includes the effect 
of a B//2 failure (note that the SPRT is still "looking" for a 
size B failure). Then, assuming a worst case initialization error, 
we find that 


E[u n ] 


(/2 - l)B 2 t^ 

6a 2 T 


2 

Bbt 

n 

— T~ 
2a T 


Let us define T^ to be the time at which this quantity crosses the 
failure threshold. Then equating the above expression to -9.2 yields 


(/2 - 1)B 2 T 2 
6o 2 T 


Bb T 

n 

— 2 — 
2a T 


9.2 = 0 


(4.3) 


and solving gives 


T = 7.3 sec 

m 


If we adopt the philosophy of setting the ETL for any test at 1.5 
we then have 


ETL - 11 sec 


4.2.2 Pitch, q, and Yaw, r 

Since the analyses for these two instruments are identical, 
we shall limit the details of the discussion to q. We use the 
relatonship from Eq. (3.16) 

q = 0 cos ()> + ij) cos 0 sin <J> 

We note that the residual for the SPRT for q is essentially the 
difference between the integrals of the left- and right-hand sides 
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of the above equation. Thus we again get a ramp in the residual for 

a bias failure in q, and Eq. (4.1) describes the form of the SPRT 

output. As in the case of p, we disregard the effect of ^ in 

determining sources of uncertainty in the residual, and, again 

2 

following the argument for p, we set a equal to twice the variance in 
the measurement of 0 

a 2 = 0.0002 rad 2 

The worst case initialization bias for the test is again taken as 
twice the standard deviation of the angle measurement, in this case 6: 

b = .02 rad 

Finally, we choose a value for BFM of twice the RSS unfailed bias in 
the yaw rate gyro 


B = .006 rad/sec 

Now we note that Eq. (4.2) and (4.3) hold for this analysis, 
and, substituting the above numbers we obtain 


T 

10.2 

sec 

c 

T 

24.2 

sec 

m 

ETL = 

36 

sec 


Again, we note that these numbers also apply to the yaw rate gyro. 


4 . 3 Attitude Gyros 
4.3.1 Introduction 

Recall our method for identifying attitude gyro failures using 
rotational kinematics. We utilize Eq . (3.18) to design two filters to 

estimate each of the angles <t> , 9, and i)j. For prediction update, we 
utilize Eq. (3.18) with all terms on the right-hand side computed 
using the average of the two sensor outputs of each type (illustrated 
in Eq. (3.19) only for if> for convenience). At measurements we update 
our estimate via Eq. (3.20) and (3.21). In Eq. (3.20) we utilize 
the two suspect <j) sensors separately — one for each of the two 
filters — in order to isolate the effect of the failed instrument 
in one and only one of the two filter residuals. 
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Recall that we store a window of the most recent residuals, and 
when a failure is detected by the redundancy trigger we manipulate the 
stored residuals to determine the corresponding residuals for the k=0 
filter. These residuals, which arise as the difference between d> 

m 

and straight integration of the right-hand sides of Eq. (3.18) from 
the initial estimate at the beginning of the window, are the inputs to 
the attitude gyro rotational kinematics SPRT's. Let us make several 
general observations: 

1. The effect on the corresponding residual of an attitude 
gyro bias failure is a bias of the same magnitude. Thus 
the form of all of the attitude gyro rotational kinematics 
SPRT outputs is 

u n = I 4 [ ! “ Y(t.)] (4 ‘ 4) 

n j=0 a z 3 

2 

2. The value of a is taken as the variance of the sensor noise 
in the corresponding attitude gyro. In our case these 
variances are all the same: 

a 2 = 0.0001 rad 2 

3. One important error source is initialization errors in 

starting the k=0 filters. These enter the residuals in a 
manner identical to the failure, and effectively decrease 
the failure which we see. There are two sources for this 
initialization error: an angle bias due to a BFM/2 bias 

in the measured value of rate, and a noise component. Since 
we use the k^O filter for initialization, the angle noise 
on this estimate is smaller than the raw measurement noise. 

In particular, we assume that the gain k and the measure- 
ment noise variance are given and we postulate a process 
noise variance which makes the gain optimal. Thus at steady 
state, the variance of the estimate is equal to the gain times 
the variance of the raw angle measurements. For our choice 
of gain, k = i, it follows that a , the standard deviation of 

o O 

the initial estimate, is given by 

a = .0036 rad 
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The bias in the initial angle estimate due to a bias in rate 
measurement of b is given by 


b = 


bT 

k 


Since the gain is chosen to be 


k = 


T 


T 


the initial estimate bias becomes 


b = bx 

o 

where x is the stipulated time constant of the filter. Now, 
we assume measured rate biases of BFM/2 , and for our choice 
of a 0.5 sec filter time constant, we have 

b Q = BFM/4 

where the BFM is for the appropriate rate instrument. 
Assuming the worst case effect to be the sum of this bias 
plus twice the filter estimate standard deviation, we obtain 
worst case initialization errors of 

M. = 0.012 rad 

* (4.5) 

M e = M ip = °- 008 rad 

As an aside, we note from Eq. (4.5) that the choice of angle 
initialization errors of 0.02 rad for the calculation of the 
rate gyro ETL's is overly conservative, resulting in some- 
what larger rate gyro ETL's than necessary. 

4. A second fundamental unmodeled effect that can create 

difficulties in the test arises from the integration of the 

right-hand sides of Eq. (3.18) . Biases in p , q , or r , 

m m m 

will produce ramps in the corresponding residuals. We note 
here that this correspondence holds precisely only in the 
9=<|)=0 case. Since these calculations are to determine 
parameter values we will assume this case for simplicity. 
During on-line operation variations in 0 and <f> will be 
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taken into account by the QSPRT. Also, as discussed in 
Section 4.2.1, we will assume that the worst-case measured 
rate biases are half the corresponding BFM's. 

To compute the effect of the ramp on the SPRT, we must 

specify the SPRT somewhat more precisely. We assume the 

following structure: given the mean time T m for the trigger 

to detect a failure of size BFM (we discuss the calculation 

of t below) , we take the residual window to be of length 
m 

4t /3. Also, we start the SPRT calculations t into 
nr m 

the window. Thus the effect of a rate gyro bias of size 
b on the residual j time steps following initiation of the 
SPRT is 


MjT + f m /3] 

where the T m /3 term is due to the effect of the ramp over 
the first quarter of the window. 

5. Given these worst-case effects and assuming a bias failure 
of size B, we can compute from Eq. (4.4) 

n R R 

E[u n ] = "T [ f - B + M + bjT + b- m /3] 

B (B-2M) t Bbt 2 Bbx t 

~ n n m n ,. , 

" 2 + 2 + 2 (4.6 

2a T 2a T 3a T 


6. In order to calculate t , we must be more explicit about 

m 

the direct redundancy trigger. Each instrument type has 
associated with it a moving window of instrument output 
differences N samples long, where N may be different for 
each instrument type. A failure is detected if the average 
of these N instrument output differences exceeds a threshold of 


BFM 

2 


+ 


e 


The sample variance of the moving window average, o s , is 
given by 
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assuming uncorrelated noise on the individual sensor outputs 

of variance v. In order to define e, we stipulate equal 

* . —4 

miss alarm and false alarm probabilities of 10 . This 

requires that 


e = 3.65 a g 


BFM 

4 


(4.7) 


with a resulting threshold of .75 BFM. This results in a 
mean time to detect of .75 NT, which using the above equations 
may be written 


T 


m 


320 v ~ 

—~2 i 


(4.8) 


2 

7. With this expression for and the given values for a 

and T, we obtain the following equation for the time at 

which Efu ] crosses the failure threshold 
n 

(8xl0 4 )bBT^ + [ 1 - ° D 7b - - (8 x10 4 )B(B-2M) ] T + 9.2 = 0 (4.9) 

C D C ' ‘ ' 


We note that this is a quadratic and hence has two solutions. 
Examining Eq. (4.6) we see that for a short time the first 
term dominates, driving E [u^] negative, but eventually the 
quadratic term dominates, making the expectation positive. 

This is not surprising, since initially we expect the step 
failure to be larger than the ramp due to possible rate gyro 
biases, but eventually the ramp will dominate. Consequently, 
we expect there to be a minimum size of B for which E[u n ) 
will reach the negative threshold, and that for any 
there will be two values of T c — the smaller corresponding 
to the time at which E[u n l first reaches the negative 
threshold, and the larger corresponding to the time it 
crosses the threshold as it approaches the positive threshold. 
Thus, we will want to choose ETL somewhere between these two 


*Recall from Section 2.2 that a false alarm is the detection of the 
presence of any bias smaller in magnitude than BFM/ 2 . 
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numbers. Examining Eq. (4.9), we see that B min can be 
calculated by determining the value of B for which the two 
solutions are identical. 

4.3.2 Bank Angle , tf> 

In this case, we use the fact that the BFM for p is .02 rad/sec 

to set 


b = .01 rad/sec 


From Eq . (4.5) we have 


M = 0.012 rad 

Examination of Eq. (4.9) with these parameter values indicates a 
minimum value of B between 0.04 and 0.05 rad. We choose the roll 
attitude gyro BFM of 


B = 0.06 rad 

Substituting this value into Eq. (4.9) gives 

T = 0.05, 3.93 sec 

c 

Since ETL must be between these two values of T , we choose 

c 

ETL = 2 sec 

Substitution of the BFM size into Eq. (4.7) gives a mean detection 
time of 


t = .56 sec 

m 
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4.3.3 Pitch Angle, 6, and Yaw Angle, ip 


Since the BFM's for g and r are 0.006, we set 

b = 0.003 rad/sec 

From Eq. (4.5) we have 

M = 0.008 rad 

Examination of Eq. (4.9) with these parameter values indicates a 
minimum value of B between 0.025 and 0.03 rad. We choose pitch and 
yaw attitude gyro BFM's of 


B = 0.055 rad 

Substituting this BFM value into Eq. (4.9) gives 

= 0.06, 12.5 sec 

and we choose the elapsed time limit as 

ETL = 3 sec 

Substitution of the BFM size into Eq. (4.8) gives a mean detection 
time of 


t = 0.66 sec 

m 


4.4 Accelerometers 


4.4.1 Introduction 

In this section, we determine the accelerometer biases and ETL’s 
to be used by the translational kinematics SPRT's. In a later section, 
we will discuss the additional analytic redundancy tests which may 
be used for the accelerometers, and the corresponding biases and ETL 1 s 
for these tests. In general, the biases being looked for in these 
various tests will be different, reflecting the different capabilities 
of the tests. For the purpose of calculating unmodeled effects in 
SPRT's for other instrument types due to biases in the accelerometers, 
we will use BFM/2 as the undetected accelerometer bias, where BFM is 
the smallest of the biases being looked for by the SPRT's for the 
accelerometers . 
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Recall that the basic equation for the translational kinematics 
SPRT's is Eq. (3.6). For each accelerometer the residual used in 
the SPRT consists of the measured velocity component in the corresponding 
direction minus the integrated velocity component as computed from 
Eq. (3.6) . 

We make the following observations : 

1. The effect on the residual of an accelerometer bias is a 
ramp. This suggests an SPRT structure of the form 

* l, 2? (S^-vCV) 

J=1 o J 

2. The first important unmodeled effect is due to bias in the 

★ 

measured values of q and r . Let us assume we are flying 
at Mach=.6 at 6.1 km and that the velocity is essentially 
along the x direction. Then rate gyro biases cause no 
errors in the channel, the r bias causes a ramp error in 

the Vy residual, while a q bias leads to a ramp in the V z 
residual. For worst case analysis we assume possible r 
and q biases of BFM/2 , corresponding to an acceleration bias 
of 0.55 m/sec in the y and z channels. 

3. One important error source in the translational kinematics 

tests is the wind term £. There are two aspects to this 

problem. First, we can encounter different levels of 

2 

turbulence and must use appropriate values of a in the 
SPRT's. Second, the wind acceleration may have low frequency 
components, i.e., wind shears, that mimic the effects of 
accelerometer failures in the residuals for several seconds. 

In order to avoid false identification due to this last 
effect, we slow the translational kinematics SPRT's down 
substantially, thus filtering out this low frequency effect. 
This will be discussed in detail shortly. 

4 . We may have errors in the initial velocity estimates due 

to two sources: biases in the accelerometers and rate gyros 

and white estimation error. Since the filter gains in this 


* , , 
p enters into the Coriolis term in a small way and is neglected 

in this analysis. 
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case are identical to the gains for the rotational kinematics 
filters, the same analysis holds as in Section 4.3.1, i.e., 
the bias in initial velocity is half the total acceleration 
bias, and the variance in the estimate is one-eighth the 

variance in measured velocity. We assume BFM values of 
2 

1.5 m/sec for the longitudinal and normal accelerometers 
2 

and 2 m/sec for the lateral accelerometers . By using 

the RSS of the effects of the accelerometer biases and rate 

gyro biases, we obtain initial velocity estimate biases of 

0.37 m/sec in V^, 0.67 m/sec in and 0.59 m/sec in V z . Now, 

noise in the estimate of V is essentially due to Mach meter 

x 2 2 

noise with a variance of 9.3 m /sec , giving a standard 
deviation of the estimate of of 1.1 m/sec. The noises 
in V and V are due to the noises in the beta and alpha 

y z 2 2 

vanes respectively, with variances of 3.3 m /sec . Thus 

the standard deviations of the estimates of V and V are 

y z 

0.64 m/sec. Assuming the worst case error in the initial 

velocity estimate to be the sum of the bias and twice the 

standard deviation, we have the following initial velocity 
* 

estimation errors : 


M = 2.6 m/sec 

x 

M = 2.0 m/sec 

y 

M z = 1.9 m/sec 


(4.11) 


Given this background, we will develop the translational kinematics 
SPRT's for the individual accelerometer types. 

4.4.2 Longitudinal Accelerometer, 


As described in Appendix A, we have designed a turbulence 
estimator to make a binary decision: "low turbulence" or "high 

turbulence". Let us assume first that we are in the low turbulence 

2 

case. In this case, a is dominated by Mach meter errors and we take 


Note that biases in the air data sensors do not concern us, since the 
initial velocity estimate will follow these biases, and this bias 
will drop out in the difference between the velocity calculated using 
air data and the velocity calculated as the integral of the acceler- 
ometer output plus the initial estimate. 
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Q , 2, 2 

9.3 m /sec 


2 

a 


In addition, as our model of a worst-case low turbulence shear, we 
have chosen a velocity profile given by 


S(t) 


(1.5 t)m/sec , 0 t <_ 6 sec 

(9-1.5 (t-6) )m/sec, 6 sec < t < 12 sec 
0 t > 12 sec 


(4.12) 


The shape of the wind velocity due to this shear is shown in 
Figure 4-1. 



Figure 4-1 Low Turbulence Wind Profile 


Finally, examining the proposed SPRT as given by Eg. (4.10), we see 
that the gain grows linearly with time. In some initial tests we 
observed that this gain became sufficiently large so that a shear 
such as that given by Eq. (4.12) could lead to the identification of 
the wrong accelerometer as failed. Thus, we have modified the SPRT 
by clipping the gain: 


n Bf (t . ) . 

I — j- 3 - Y(t.)) 

j=l a 1 3 


(4.13) 


where 


f(tj) = min (tj,T Q ) 
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and the time T is to be determined so that in the worst-case shear with 
o 

no other error sources the expectation of u(t n ) will just touch (but 
not exceed) the failure threshold when there is no failure. 


From Eq. (4.13) we calculate 


E[u n J 


I 

j=l 


Bf (t j ) 


,BjT 
l 2 


S(tj)) 


We now set 


B f(t)t 
2 o 2 T 


Bf (t)S(t) 

T — — 

a T 


dt 


(4.14) 


B = 1.5 m/sec 2 


for a and note that the maximum value of E [u ] occurs when 
x n 


BT* 

2 


S (T*) 


Solving, we find 


T* = 8.1 sec 

Using the parameter values established so far, we choose T o so that 

E [u* ] = - 9.2 


This leads to 


T = 0.2 sec 

o 

Now, we assume a B//2 failure, worst-case low turbulence shear, 
and worst-case velocity initialization error. The expected value of 
the SPRT output in that case is given by 

(/2 - l)B 2 f(t)t + Bf (t)S(t) + MBf (t) 1 dt (4>15) 
2o 2 T o 2 T ct 2 T J 
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Substituting our parameter values into Eq. (4.15) and solving gives 

T = 33.3 sec 

m 


and therefore we choose 


ETL - 50 sec 

Now let us consider the high turbulence case. In this case the 

worst-case shear is taken to be twice the shear given in Eq. (4.12), 

and we wish to modify the SPRT to accommodate this shear. Specifically, 

2 

we wish to leave T fixed at 0.2 sec and increase a so that the most 
o 

negative value of Efu^] is exactly -9.2. In this case, the most 
negative value of E[u n ] occurs at T, where 

~ = 2S(T) 

Solving, we find 

T = 9.68 sec 

2 

and the new value of a is 

a = 33 m /sec 

Now, again assuming an accelerometer bias of B//2, worst-case high 
turbulence shear and worst case initial velocity error, we solve 
Eq. (4.15) with the new parameters to obtain 

T = 44.5 sec 

m 

and we choose for this high turbulence case 

ETL = 67 sec 

4.4.3 Lateral and Normal Accelerometers, A and A 
y z 

For these cases, we must consider the unmodeled effects due to 

possible rate gyro biases. This bias can cause ramp effects in the 

2 

residuals of the form bt, with b=0.55 m/sec . We proceed in the 
analysis as follows. 
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First, because of this rate gyro bias effect, we must look for 
larger bias failures. Specifically, we choose 

2 

B = 2 m/sec 


Again, we must clip the SPRT gain and we follow an analogous approach 
to that used in the a^ case. That is, we assume no failure and a 
worst case shear, but no gyro bias effect (since when RSS'd with the 
shear the contribution of such a bias is quite small) . Given these 
conditions, we want E [u n ] to touch but not exceed the failure threshold. 
Thus, we can use Eq. (4.14), and evaluate T* , the point at which the 
expectation reaches a minimum. Again, this occurs when 


BT* 

2 


and using B=2 m/sec 


we obtain 


S (T*) 


T* = 7.3 sec 


and solving for the time T q at which the gain is clipped we find again 

T = 0.2 sec 

o 

2 

Now with a =9.3, we calculate the time to cross the failure threshold 
assuming a failure of size B, worst-case shear in low turbulence, 
worst-case initialization error and worst-case gyro bias. The 
expectation becomes 


E[ 


■, _ f n r-B 2 f(t)t , Bf(t)S(t) , MBf(t) , Bbf(t)t~| 

' f ° L 2 „ 2 t 7i J 


dt 


Using M=2.4 from Eq. (4.11) and the other relevant parameters, we find 


T = 24.4 sec 

c 


We note that because of the worst-case rate gyro bias, we cannot 
identify a failure of B//2". Thus, we limit ourselves to identifying 
failures of size B and choose 


ETL = 37 sec 
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Finally, we consider the high turbulence case. Following the 

2 

same approach as m the longitudinal accelerometer, we increase a to 
2 2 

47 m /sec and obtain 


T = 35.1 sec 

c 

ETL = 53 sec 


4 . 5 Altimeters 

For the altimeters we have only one form of analytic redundancy, 
altitude kinematics, based on the relationship 

h = a^ sin 0 - a^ sin <j> cos 0 - a^ cos <j> cos 6 - g (4.16) 

We implement one filter based on Eq. (4.16) for each altimeter 
measurement and store a window of residuals. Once the redundancy 
trigger detects a failure, we use these residuals to determine the 
residuals for a k=0 filter (straight integration of Eg. (4.16), 
starting at the beginning of the window) . These residuals form the 
input to the SPRT's. We note the following: 

1. The effect of an altimeter bias failure on these residuals 
is a bias of the same size, assuming the failure occurs 

in the window. 

2. In the same way we performed the calculation for the 
attitude gyros, we determine a relationship between the 
mean time for trigger detection and the BFM size B: 

m b 2 

2 

where a is the altimeter noise variance. As in the 

attitude gyro case, we set the window size at 4 t /3 and 

m 

start the SPRT calculations x into the window. 

m 

3. The major unmodeled effects are in the open loop integration 
of Eq. (4.16). Any error in our initial condition on h 
will lead to a ramp in the residual, while (assuming level 
flight) any undetected normal accelerometer measurement 
bias b (up to BFM/2) will lead to an error in the residual 
quadratic with time. For our choice of gains, this velocity 
error will be numerically equal to the normal acceleration 
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bias. We define the total velocity error, due to accelerometer 
bias and measurement noise, e, to be 

* 

e = 1.37 m/sec 

4. Initial altitude error is dominated by the altimeter 
quantization size, and we define this initial altitude 
error, M, to be one quantum size 

M = 3.4m 

Now, assuming a failure of size B and the worst-case unmodeled 
effect, the expected value of the SPRT output is given by 

E[u ] = l -^2 f M " § + eT (j+q) + — Y 2 — (j+q) 2 ] 
j=l a 


where 


107 o 2 

" = 

The above expression may be approximated by the integral 

t^ 2 

E [u ] » / [M - | + b fo T) - + eqT + (e+bqT)t + ] dt (4.17) 

n Ta 2 ° 2 2 2 

Using the values of e and M given above, and the additional values 

2 n , 2 
a = 9.3m 

B = 30 m 

2 

b = .75 m/sec 

Eq. (4.17) gives the following times at which E[u n ] crosses the failure 
threshold 


T = .016, 2.65 sec 

c 

As in the case of rotational kinematics for the attitude gyros, the 
expectation crosses the threshold twice, first when the altitude bias 
term dominates and later as the velocity and acceleration biases 

*See Appendix E for a discussion of the altitude filters 
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dominate, driving the expectation positive. Based on the above 
calculations, we choose for the altimeter 

B = 30 m 

ETL = 2 sec 

4 . 6 Alpha Vanes and Mach Meters 

Recall that bias failures in these instruments are identified 
using the translational dynamics SPRT, in which we compare accelerations 
as measured by the accelerometers with those computed from a, Mach, 6 , 
etc. , using approximate equations for the relationships between these 
variables and lift and drag. Recall also that both a and Mach affect 
accelerations in both the x- and z-directions and thus the SPRT uses 
a two-dimensional residual vector. 

In order to determine parameters (BFM's, ETL's) for a and Mach 
sensor failures, we must use a linearized model for the effect of 
failures on the computed forces. Specifically, let denote the 
the computed acceleration in the x-direction, and let F 3 denote that 
in the z-direction. Let 

3F . 

X • = Tr-i 

ia 3a 

Trim, i=l , 3 

3F . 

X = 1 

\.J( 3 ^/ 

Trim, i=l , 3 

We have used the following values for these quantities, evaluated at 
trim at Mach=0.6, h=6.1 km 


la 

2 

2.6 m/sec 

rad 

3a ~~ 

2 

183 m/sec 

rad 


2 

2.3 m/sec 

Mach 


21.7 m/sec^ 

Mach 
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Given these values, the first order effect of a bias failure of size 

B„ in a is a bias of 
a 


in the x-acceleration calculation, and 


'3a 


in the z-acceleration calculation. Similar calculations hold in the 
case of oft, and from now on we will drop the subscripts "a" or "oft " 
since the analyses in the two cases are identical form. 

There are three major ummodeled effects: undetected biases in 

the a or a accelerometers, a bias in the measured value of the other 
x z 

air-data sensor, and biases in the approximate expressions for 
and F, . These biases are due both to inaccuracies in our knowledge 
of the precise functional relationships and also to errors in the 
approximate forms for the aerodynamic coefficients used on-line. 

These approximations are used in order to reduce the storage require- 
ments, which are extremely high if tables are used (see Appendix B) . 

Given these assumptions, an approximation to the expectation of 
the SPRT is 



(4.18) 


where 

2 

b-^ = b 3 = undetected x,z bias = .73 m/sec 
AF^,AF 3 = x- , z-direction table error 

,n 3 = x- , z-direction error due to bias in other air-data sensor 


For our purposes Eq. (4.18) is extremely conservative since b^ , AF^, 
b^ , AF 3 n 3 are all at their maximum values and all are in the worst 
directions. On probabilistic grounds, one can argue that they should 
be replaced by an RSS of all four effects. This yields 


53 



(4.19) 


where 



Note that from Eq. (4.19) it is clear that in order to detect the 
failure we must have 


B > 


2b 

— 2 T 

(*1 + A^) 


B 


mm 


(4.20) 


For given values of AF^ and AF^, and B satisfying Eq. (4.20), 
the time to cross the failure threshold can be calculated from 
Eq. (4.19). In particular, for the alpha vane, we choose 

2 

AF 1 = AF^ = .56 m/sec 

2 

n x = .12 m/sec 

2 

n 3 = 1.1 m/sec 

which yields 

B . = .016 rad 

min 

We choose the bias for alpha to be 

B = .0175 rad 


which yields 


and we choose 


T c = 9.5 sec 


ETL = 16 sec 


With the identical choice for AF^ and AF^ for the Mach meter and 

2 

= .032 m/sec 


ri^ = 2.2 5 m/sec ^ 


we obtain 


B = .22 Mach 

min 
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We choose B for the Mach meter to be 

B = .23 Mach 


which yields 


and we choose 


T =13.2 sec 
c 


ETL = 18 sec 


4 . 7 Additional Tests 

4.7.1 Introduction 

We note that failures in some instruments may be found using 

* 

more than one form of analytic redundancy . Up to this point, we 
have only determined biases and ETL's for each instrument type for one 
form of analytic redundancy SPRT. We now examine the remaining 
possibilities, calculating biases and ETL's for each. Note that this 
means that a given instrument may have different biases and ETL's 
in the SPRT's for different forms of analytic redundancy. 

4.7.2 Pitch and Yaw Rate Gyros 

It is possible to use translational kinematics to identify bias 

failures in these instruments through the Coriolis term in the 

acceleration equation. The analysis in Section 4.4.3 holds (and is 

identical for q and r) , except we reverse the roles of accelerometer 

and gyro biases. That is we must consider a BFM/2 undetected 

measurement bias in a or a . Also, assuming a nominal velocity 

y z 

of 183 m/sec, the error in Coriolis acceleration due to a B bias in 

2 

q or r is (183 B) m/sec (here B is measured in rad/sec) . Assuming 
equal acceleration measurement errors in the y and z directions of 
2 

1 m/sec , we obtain for the low turbulence case 

B = 0.015 rad/sec 

ETL = 38 sec 


Sensors with no additional tests include p, ip and h. 
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and for the high turbulence case 

B = 0.015 rad/sec 

ETL - 55 sec 

The translational kinematics SPRT's in these cases use the same 
clipped gains as those derived in Section 4.4.3. 

4.7.3 Roll and Pitch Attitude Gyros 

It is possible that either translational kinematics or altitude 
kinematics could be used to detect <j> or 0 bias failures when the 
aircraft attitude is within certain regions. Since such tests are 
very much flight trajectory dependent, it is impossible to determine 
universal detection parameters , and it seems most appropriate to 
design several trajectories that the pilot could fly to allow us to 
detect such failures. This issue has not been considered in detail 
and awaits future investigation. 

4.7.4 Longitudinal Accelerometer 

It is possible that altitude kinematics could be used to identify 
a^ sensor failures, but again this is trajectory dependent and needs 
further study. We can, however, consider the use of translational 
dynamics to pick up a^ bias failures. In analogy with Section 4.6, 
we can write down a linearized expected value for the likelihood ratio 


E[u n ] 


where in this case 


l 

j=l 





(4.21) 


b = A 2 b 2 + X? y/ b 2 + AF 2 (, 

la a 1 v 

and V ht are taken as BFM//T and BFM/2 respectively . Assuming 

B = 2.4 m/sec 2 

AF 1 = .59 m/sec 2 

2 Q , 2, 4 

a = 9.3m /sec 


* 


The BFM for Mach is 0.1 and 


is derived in Section 4.7.7. 
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we use the parameters given in Section 4.6 and compute 

ETL = 45 sec 

4.7.5 Lateral Accelerometer 

Again in this case we might be able to use altitude kinematics, 
but we leave this trajectory -dependent analysis to the future. 

Although we have not implemented a translational dynamics SPRT for 6 
(since we have only one 6 vane) , we can use such an SPRT to identify a 
bias failures. Again, the form of the expectatioh of the likelihood 
ratio is given by Eq. (4.21) where b models table errors and the 
effects of biases in the 0 vane. We have used a value of 0.3 m/sec 2 
for b. We then choose 

2 

B = 2 m/sec 

2 n c 2 , 4 

c = 7.6m /sec 

and calculate the time to identify a BFM //T 1 failure as 

T = 6.9 sec 


and choose 


ETL = 11 sec 


4.7.6 Normal Accelerometer 

We first examine the use of translational dynamics. We can 
utilize Eq. (4.21) and modify Eq. (4.22) by changing the "1" 
subscript to a "3". We choose 


and calculate 


2 

B =5.5 m/ sec 

2 

AFg = .59 m/sec 

2 „ , 2 , 4 

a = 9.3 m /sec 

ETL - 8 sec 
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We now note that a z failures can also be identified using altitude 
kinematics. We will assume level flight, and in this case an a z 
bias enters quadratically in the residual. Thus for a bias B the 
expectation of the SPRT output is 


:tu„l - I 

n j=l 2 o L 4 D J 


2 

where o = 9.3, the variance of the altimeter measurement noise. 
Assuming worst case initialization errors in altitude and altitude 
rate of M and e respectively, the expected SPRT output for a failure 
of B//2 1 becomes 


E [u ] = l ^ - y- . T (1 - /2) + ejT + M) 

n j = l 2a q 


which can be approximated as 


„ 1 rB 2 t 5 „ pr. Bet 4 . BMt 3 ~| , 

n |^*40 _ 1 ~ + 8 + 6 J (4 ' 2 

2 

Solving for T , with B = 1.5 m/sec , e = 1.37 m/sec, M = 3.4m gives 

T =14 sec 
m 


and we choose 


ETL = 21 sec 


4.7.7 Mach Meters 

Because a bias in the a vane does not produce an appreciable 
bias in V , translational kinematics cannot be used to identify step 
failures in this instrument of less than about 0.2 rad, and thus is of 
little use for this instrument. However, translational kinematics is 
useful for identifying step failures in the Mach meters. The 
development closely parallels the use of rotational kinematics to 
identify step failures in the attitude gyros. Thus we have two first- 
order uncoupled velocity estimators, each using a different Mach meter 
as the measurement, and we store a window of residuals for each. 
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We design the test to look for a Mach bias B and calculate the 
two times T m that the expectation of the SPRT output crosses the 
failure threshold for a B failure. We assume an x velocity 
initialization error of M, an x acceleration bias b due to the RSS of 
BFM/2 acceleration measurement bias and wind shear, and a Mach variance 
v to obtain 

nVBfVB , m "| 

Efu 1 = l “2 + M + b (jT + ) 

n j=l a z L z B z J 

Approximating the above equation by an integral and setting it to the 
failure threshold gives 


V Bb 

* 


+ 


v B r 

~T~ I 

a T L 


V B 
s 

~T~ 


+ M + 


107 bvT ~[ 

B 2 J C 


+ 


9.2 


0 


(4.24) 


Now, the initialization velocity error from Eq. (4.11) is 

M = 2.6 m/sec 

The speed of sound at 6.1 km is 

V s = 316 m/sec 


The variance of the Mach meter is 

v = 10 


and we choose 


B = .1 

In low turbulence , the variance of the translational kinematics 
residuals is given by 


2 „ 0 2 . 2 
o = 9.3 m /sec 

and the value of b, the RSS of wind shear and BFM/2 acceleration 
measurement bias, is given by 

2 

b = 1.69 m/sec 
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From Eg. (4.24), we calculate 


T = .013, 15.2 sec 

c 


and choose 


ETL = 7 sec 


In high turbulence , we have 


2 ,, 2 . 2 
a = 33 m /sec 

2 

b = 3.14 m/sec 


and we calculate 


T = .05,8 sec 

c 


and we choose 


ETL = 4 sec 


4 . 8 Summary 

In this section we have derived a consistent set of baises and 
ETL's to be used by the various analytic redundancy SPRT's for the 
different instruments. The minimum value of the biases used by the 
applicable SPRT's for each instrument type is defined to be the BFM 
for that type, and it is this bias level which the redundancy trigqer 
is designed to detect. For the accelerometers attitude and rate 
gyros, at least one form of analytic redundancy test can identify 
failures of size BFM//2, and thus the worst-case biases on these 
measurements entering other tests is assumed to be BFM/ 2 . For the 
alpha vanes, Mach meters, attitude gyros and altimeters, the worst 
case measurement errors are assumed to be BFM//2. Table II presents 
a summary of the results presented in this section, with question 
marks indicating possible tests which have not been fully investigated. 
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Table II Summary of FDI System Parameters 



Translational Kinematics 



Sensor 

Type 

1 

Low 1 High 

Turbulence ( Turbulence 

i 

i 

B ETL i B ETL 

1 

Rotational 

Kinematics 

B ETL 

Altitude 

Kinematics 

B ETL 

Translational 

Dynamics 

B ETL 

BFM 

a x (m/sec 2 ) 

1.5 , 50 

1.5 , 67 


7 

2.4 , 18 

1.5 

a y (m/sec 2 ) 

2 , 37 

2 , 53 


7 

2 , 11 

2 

a z (m/s ec 2 ) 

2 , 37 

2 , 53 


1.5 , 21 

5.5 , 8 

1.5 

Mach 

0.1 ,7 

0.1 ,4 



0.23 , 18 

0.1 

a (rad) 





0.0175 , 16 

0.0175 

p (rad/sec) 



0.02 , 11 



0.02 

q,r (rad/sec) 

0.015 , 38 

0.015 , 55 

0.006 , 36 



0.006 

<j) (rad) 

? 

? 

0.06 <■ 2 

7 


0.06 

0 (rad) 

? 

7 

0.055 > 3 

7 


0.055 

(rad) 



0.055 f 3 



0.055 

h (m) 




30 ' 2 
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SECTION 5 


QUALITY SPRT's 


As we have discussed, the various SPRT's have been designed to be 
somewhat conservative, i.e., we have chosen design parameters (BFM, 

ETL) and SPRT structure (e.g., the use of a clipped gain in the 
translational kinematics SPRT) to hedge against possible unmodeled 
effects. In order to judge the value of any given test, however, one 
must take into account such possibilities as the effect of maneuvers, 
flight condition, and the size of the failure as indicated by the 
difference between the two identical instruments following a redundancy 
trigger. Since such effects must be determined on-line, we were led 
to the conclusion that we need . to calculate on-line some statistic that 
tells us the quality of each SPRT. Specifically, our goal was to 
determine a statistic such that we could be sure a given SPRT was good 
if the statistic said it was. This philosophy led to the development 
of the quality SPRT (QSPRT) . 

Basically, for each analytic redundancy test the QSPRT computa- 
tion involves the calculation of the worst-case expected values of the 
likelihood ratios of the failed and unfailed instruments of the given 
type. That is, given all relevant flight information (sensor outputs, 
maneuver or turbulence indications, etc.) we compute the worst-case 
unmodeled effects. These are then used to determine the worst-case 
expectation of the SPRT output for the unfailed instrument. For the 
failed instrument we combine the worst case expectation with an 
expected failure size to determine a worst case expectation for the 
SPRT for the failed instrument. In the case of a redundancy trigger, 
the expected failure size is determined using the difference between 
the two suspect sensor outputs. For a time trigger, we simply assume 
a B-sized failure. In some sense, the QSPRT is a direct measure of 
signal strength versus noise strength and thus provides an excellent 
statistic for determining the quality of the test. 
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The general form for the QSPRT can be derived as follows. For a 
redundancy trigger, the SPRT output for each instrument is of the form 


u 


n 


J l G (t . ) M (t . ) - l G (t . ) y (t . ) 
Z j=l 3 3 j=l 3 3 


(5.1) 


while for a time trigger, generalizing Eq. (2.7), the SPRT output 
for each instrument is of the form 


u 


n 


1 n 

y l G(t )M(t ) 
j=l 3 3 


l G (t . ) y (t . ) 
j=l 3 3 


(5.2) 


In the above equations, M(t^) is the expected mean in the residual 

Y(t.) caused by a B-sized failure and G(t.) is the SPRT gain, which 

3 2 3 
is M(t j)/o in all tests but translational kinematics. We note that 

G(tj) and M(t^) are of the same sign, and both are assumed positive 

for this analysis. 


Now, define m(t^) to be the magnitude of the bias in Y(t^) 
which we expect to see. For a time trigger m(t^) is clearly equal to 
M(tj), since we must assume the existence of a B-sized failure. 

For a redundancy trigger, m(t^) is calculated from the difference 
in the sensor outputs. Let b(tj) be the magnitude of the worst-case 
unmodeled error in Y(t^) due to all sources of error in the analytic 
redundancy test. Then, the worst-case expectation for the SPRT for 
the failed instrument is 


n 

WCF = l G(t 

j = l 

and the worst-case for the unfailed instrument is 

n 

WCU n = I G(t 

j = l 

Note that in Eq. (5.3) b(t^) drives WCF positive , decreasing the 
probability of correct identification, while in Eq. (5,4) it drives WCU 
negative , increasing the probability of declaring the wrong instrument 
as failed. Clearly, we should not be willing to believe the test unless 


fM(t.) 


(5.4) 


*>[ 


M(t.) 

2^ + b <V 


m (t j ) 


(5.3) 


n 

C E WCF - WCU = l G (t . ) [2b (t.) - m(t.)] < 0 (5.5) 

11 11 11 -? = 1 J J J 
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Let us enumerate the conditions under which Eq. (5.5) may hold. The 
first is when 

WCF n < 0 , WCU n > 0 (5.6) 

Clearly this is the best conceivable case. The next possibility is 

WCF n < 0 , WCU n <0 (5.7) 

In this case the unfailed instrument may appear to have failed, i.e., 
its SPRT may be negative, but the SPRT of the failed instrument is 


even more negative (by Eq. 

(5. 

5) ) . 

The final case is 

WCF 

n 

> 

0 , 

wcu n > 0 


and in this case the failed instrument may appear unfailed, but the 
unfailed instrument looks even more so (by Eq. (5.5)). Finally, 
note that for a time trigger with m(t^) = M(t^) we have 

WCF = - WCU (5.9) 

n n 

Thus, Eq. (5.5) holds if and only if WCF n < 0. 

Based on these observations, we have devised the following rule 
for defining the QSPRT : 

1. If we are on a time trigger 

QSPRT = WCF 

n n 

2. If we are on a redundancy trigger 

a) If C <0 
n 

QSPRT = WCF 

n n 


b) If C > 0 
n — 

QSPRT n = +9.2 

In the outer loop logic (see Section 6) the QSPRT ' s are used to 
determine which tests should be believed. A test is believed only if 
QSPRT^ < 0, with increasing confidence being given as it becomes more 
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negative. Thus, we can determine the effect of the above definition 

of QSPRT. For time triggers, there is no difficulty, since we believe 

the test only if WCF n <0. In the case of redundancy triggers, we 

must have C <0 and WCF < 0 to believe the test. Referring to 
n n 

Eg. (5.6) through (5.8), we see that there are two cases in which this 

will hold. In the first of these, Eq. (5.6), we see that the test 

has a sufficiently high signal-to-noise ratio to determine which 

instrument has failed and which has not (WCF < 0, WCU > 0). 

n n 

Consider the case of Eq. (5.7), where we also assume that 
Eq. (5.5) holds. In this case, the unmodeled bias is sufficiently 
large so that it could make the unfailed instrument appear failed. 
However, the actual failure size, as measured by m(tj), is even larger; 
and thus the SPRT for the failed instrument is even more negative. 

Hence, we use a negative value for the QSPRT, indicating that we can 
decide which instrument has failed. One might think that if Eq. (5.7) 
holds, we might want C n < -L for some positive number L to guarantee 
that the actual SPRT of the failed instrument is truly less than that 
of the unfailed instrument. However recall that in calculating the 
two SPRT's, identical information is used except for the suspect sensors 
Hence, the difference between the actual SPRT's is due solely to the 
differences in suspect sensor outputs, and this is precisely what C^ 
measures, where C fi is even more conservative in that it takes into 
account the possibility of a worst-case bias. Thus if C n < 0, we can 
be sure that the failed instrument has a smaller SPRT than the 
unfailed one. 

Examining Eq. (5.8) , we see that if < 0 but WCF^ > 0 , we 
are setting QSPRT n = WCF n > 0. This means the following: If Eq. (5.5) 

and (5.8) hold we know that the unfailed instrument will have a more 
positive SPRT. However, in our design we have chosen to be conservative 
That is, in this case, we will not declare the least positive of the 
SPRT's to be that of the failed instrument. Rather, we require that 
the SPRT be able to positively identify the failed instrument 
(i.e., WCF < 0) before we will make a decision. A decision rule 
under the conditions of Eq. (5.8) could easily be derived, but we have 
chosen not to do so in this study. 

The error sources contributing to b(tj) for the various forms 
of analytic redundancy for each instrument type include all those 
sources enumerated in Section 4, including initialization errors, 
wind shear for translational kinematics and table errors for 
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translational dynamics. In addition the QSPRT includes all state- 
dependent error sources, evaluated not at trim as in Section 4, but 
at the measured vehicle state. 

All sources of error for the various types of analytic redundancy 
are indicated below. The time-varying coefficients of these sources 
are added after the beginning of the test to allow cancellation for 
oscillatory meneuvers. The worst-case contributions of these 
individual error sources are then added at each sample time except 
for translational dynamics, in which case the effects are RSS'd. For 
a particular suspect instrument type using a particular analytic 
redundancy test, all error sources but that of the suspect type are 
used in the QSPRT calculation. The redundancy types and associated 
error sources are as follows: 

1. Translational Kinematics 

a) V initialization error 

b) Pitch and yaw rate measurement biases 

c) Acceleration measurement biases 

d) Wind shear 

e) Pitch and yaw attitude measurement biases 

2. Rotational Kinematics 

a) Angle initialization error 

b) Attitude rate measurement bias 

c) Attitude measurement bias 

d) Axis misalignment 

e) Rate gyro scale factor error 

3. Altitude Kinematics 

a) Initialization error in h and h 

b) Acceleration measurement biases 

c) Pitch and roll attitude measurement biases 

4. Translational Dynamics 

a) Table errors 

b) Acceleration measurement biases 

c) Air-data measurement biases 
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SECTION 6 


OUTER LOOP LOGIC 


6 . 1 Introduction 

In Section 4 we discussed the selection of a consistent set of 
B's and ETL ' s for the various analytic redundancy tests for the 
different instrument types. The BFM for each instrument type was 
then defined to be the smallest B for the various applicable analytic 
redundancy tests. In these calculations, all maneuver-dependent error 
sources were evaluated at trim at Mach 0.6 at 6.1 km altitude. The 
ETL for each test for a given sensor type was defined to be 1.5 times 
the time required, at trim, for the expectation of the SPRT output 
for the failed sensor to cross the failure threshold. In Section 5, 
we discussed the QSPRT, which is a measure of the signal-to-noise 
ratio of its associated analytic redundancy test. The QSPRT calculates 
worst-case effects of all relevant error sources, using the measured 
aircraft state to evaluate maneuver-dependent terms. In this section, 
we discuss the outer loop failure identification logic, which uses the 
SPRT and QSPRT outputs of all the analytic redundancy tests for a 
particular instrument type in order to identify a failed instrument. 

We also discuss some other functions of the outer loop, such as time 
trigger initiation. 

6 . 2 Failure Identification - Redundancy Trigger 

Following a direct redundancy trigger, all SPRT 1 s and QSPRT' s 
associated with the suspect instrument type are begun, including the 
direct redundancy SPRT. Also, all SPRT and QSPRT calculations 
associated with any currently running time trigger are terminated, 
to be reinitiated following resolution of the direct redundancy trigger. 
This resolution may be accomplished in three ways: indication of a 

false alarm, identification of the failed instrument, or indication of 
an unidentifiable failure. A false alarm counter for the suspect 
instrument type is incremented if after a nominal period of time. 
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currently 0.5 seconds, the output of the direct redundancy SPRT becomes 
positive. This false alarm indication causes all calculations initiated 
by the direct redundancy trigger to stop, and the direct redundancy 
trigger calculations are restarted. 

The task of failure identification is made quite simple by the 
QSPRT. We are currently using the following logic for failure identi- 
fication, but many variations are possible, and some may prove more 
effective following extensive system tests. 

Recall from Section 5 that we have chosen a conservative approach 
to failure identification in that we will only fail an instrument on 
the indication that the instrument has failed and not on the indication 
that its counterpart has not failed. Consequently we are using WCF as 
the QSPRT output (or +9.2 when C n ^ 0) . At each sample time t , we 
make a failure identification check using each form of analytic 
redundancy. We make this check only for the instrument with the 
smallest SPRT, call it instrument j. Then at time t before ETL for 
the particular test, we declare instrument j failed if 

OSPRT < -9.2 and SPRT" 1 < -9.2 
n — n — 

At time t at or beyond ETL for the test, we declare instrument j 
failed if 


OSPRT < 0 and SPRT 11 < -9.2 
n n — 

or 

QSPRT < -9.2 and SPRT 3 < 0 
n — n 

If at any sample time any test declares an instrument failed, the 
status of that instrument is changed to failed and the direct redundancy 
trigger has been resolved. Subsequently, the failed instrument is not 
used in any control or FDI calculations, and dual redundancy no longer 
exists for that instrument type. 

If the longest ETL for all analytic redundancy tests is reached 
without resolution of the redundancy trigger, a pass counter is 
incremented. If the value of the pass counter is no larger than N , 
the QSPRT's and SPRT's are restarted, and the failure identification 
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checks continue. In the unlikely event that the value of the pass 

counter exceeds N*, an unidentifiable failure flag is set for the 
P 

suspect instrument type. At this point the pilot may maneuver (or 
stop maneuvering) the aircraft in order to enhance the identif iability 
of the failure. 

During the failure identification check using any form of ' analytic 
redundancy, the instrument with the lowest SPRT is provisionally failed 
if 

QSPRT < 0 and SPRT 11 < 0 
n n 

The provisionally failed instrument is removed from all control calcu- 
lations, but the failure identification tests continue until resolution 
of the trigger. Only one instrument of a given type is ever provisionally 
failed, and a provisional failure during the current test overrides 
any previous provisional failure. Also, the provisional failure status 
of an instrument is removed if its counterpart is identified as failed. 
This capability of the dual-redundant system to make provisional 
failures tends to minimize the time required to remove a failed sensor 
from the system without a corresponding increase in false identifications. 

6 . 3 Failure Identification - Time Trigger 

Following initiation by the time trigger, all applicable analytic 
redundancy QSPRT and SPRT calculations are begun. No decision is made 
until the longest applicable ETL is reached. At that time an instru- 
ment is declared provisionally failed if for some form of analytic 
redundancy the SPRT associated with the instrument is less than the 
QSPRT and the QSPRT is less than -9.2. The instrument is declared only 
provisionally failed to allow its use following the identification, 
via a redundancy trigger, of the hard failure of the other instrument. 


6 . 4 Additional Outer Loop Tasks 

In addition to its primary task of failure identification, the 
outer loop performs some "bookkeeping" tasks which we enumerate below. 

The outer loop schedules the time triggers for those instrument 
types whose failures are observable in at least one analytic redundancy 
test at any time subsequent to the failure. As we saw in Section 4, 


* 

Currently we use N p = 
gyros and altimeters. 


3 for all instruments but the yaw attitude 

for which N =1. 

P 
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all instruments except the yaw attitude gyros and altimeters are in this 
category. However, since the observability of and 6 failures in the 
altitude kinematics tests is so maneuver-dependent, we also exclude 
those instruments from the time triggers. Thus in the absence of a 
direct redundancy trigger, the outer loop cycles through a list containing 
the rate gyros, accelerometers, Mach and alpha sensors, calculating QSPRT's 
and SPRT's for one instrument type at a time. If no failure is 
identified within the longest ETL for a particular instrument type, 
the calculations for that type are terminated and the calculations for 
the next instrument type in the list are begun. When the calculations 
for the last type in the list are terminated, the calculations for the 
first type in the list are begun. If a direct redundancy trigger 
occurs, all calculations being performed for the time trigger are 
terminated, and these calculations are not restarted until after 
resolution of the direct redundancy trigger. 

As discussed in Appendix D, a possibility exists for the 
simultaneous failure of the indications of <J> and 9 from a vertical gyro, 
and a methodology is presented there for the identification of the 
failed unit. The logic involved in that decision process would be 
performed by the outer loop. 

Although not currently implemented, the outer loop could schedule 
analytic redundancy failure checks in previously failed instruments 
in order to take advantage of possible instrument "healing". 
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SECTION 7 


SIMULATION RESULTS 


7 . 1 Introduction 

In this section we present some representative results obtained 
using the analytic redundancy FDI algorithm described in the previous 
sections in conjunction with the nonlinear six degree of freedom real- 
time F— 8 digital simulator at the NASA Langley Research Center. For 
these results, the simulated aircraft was at the design flight condition 
of Mach 0.6 at 6.1 km altitude. The control surfaces were trimmed for 
horizontal flight, and the simulated sensor outputs were corrupted by 
white noise and quantization as characterized by the parameters indi- 
cated in Table I. It is important to note that all variables are 
truncated at the upper and lower ordinate values given in the figures. 

7 . 2 Time Trigger Performance 

As indicated in Section 6, the outer loop is designed to monitor 

the status of the rate gyros, accelerometers, Mach meters and alpha 

vanes via cyclical time trigger initiation. This procedure was tested 

at two levels of turbulence: zero turbulence and thunderstorm 

* 

turbulence with rms winds of 6.4 m/sec . For the case in which all 
instruments have zero bias values, the FDI algorithm performs as expected 
following time trigger initiation for both turbulence levels, i.e., 
each instrument of every type is correctly indicated as unfailed. Thus 
no false alarms occurred in the simulations with zero bias. 

Additional time trigger simulations were performed in which the 
number 2 instrument of every type contains a bias of +0.4 BFM. This 
bias is within the allowable tolerances for unfailed instruments, but 
its level approaches the limits of these tolerances. The results of 
these simulations at the two turbulence levels will be discussed in 
detail below for the various instrument types. 

_ - * 

Note that this figure is 16% higher than the Dryden wind model used 
to derive the high turbulence "worst case" shear in Section 4.4.2. 
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7.2.1 Rate Gyros 


Figure 7-1 shows the results for the rate gyros. The left side 
indicates the behavior during no turbulence while the right side 
indicates behavior during thunderstorm turbulence. On each side, results 
are shown successively for the roll (p) , pitch (q) , and yaw (r) rate 
gyros. Ten variables are plotted? they are in order from the top: 


1) 

Rotational ! 

kinematics (RK) 

QSPRT 

2) 

RK 

residual 

for instrument 

1 

3) 

RK 

residual 

for instrument 

2 

4) 

RK 

SPRT for 

instrument 1 


5) 

RK 

SPRT for 

instrument 2 


6) 

Translational kinematics (TK) QSPRT 

7) 

TK 

residual 

for instrument 

1 

8) 

TK 

residual 

for instrument 

2 

9) 

TK 

SPRT for 

instrument 1 


10) 

TK 

SPRT for 

instrument 2 



As indicated in Section 4.7.2, the relatively small value of the angle 
of attack precludes the use of TK for identifying roll rate gyro failures. 
Thus, variables 6-10 are not applicable to the roll rate gyro. As 
mentioned before, all variables are truncated in the figure at the 
upper and lower limits indicated. 

Consider the case of no turbulence, shown on the left in the 
figure. At t=0 the roll rate gyro time trigger is given, and the 
calculations of the RK QSPRT and the SPRT's for the two instruments 
are begun. Note that the RK residual for instrument 2 contains a ramp 
due to its bias, while the ramp is absent in the residual for unbiased 
instrument 1. The RK QSPRT initially is positive, reflecting the worst- 
case assumption for <f> initialization error. It becomes negative after 
about 3 seconds, due to the dominating effect of the assumed BFM failure 
in the roll rate gyro. The RK SPRT's for instruments 1 and 2 cross 
the no failure boundary after about 2 seconds. These SPRT's reflect 
the absence of a ramp with a slope of magnitude BFM in the residuals 
for either of the two instruments. 

After 11 seconds the RK ETL for the roll rate gyro is reached. 

As mentioned in Section 6.3, no decision is made on a time trigger 
until the longest applicable ETL is reached. Thus, because only the 
RK test is available for the roll rate gyros, the RK QSPRT and SPRT's 
for the two instruments are examined at this time. The QSPRT is below 
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the failure threshold indicating that the RK test is good, and the 
SPRT's for both instruments are positive. Thus no failure is indicated. 
We note that the truncation in the figure hides the extreme magnitudes 
of the SPRT's, which in this case reach approximately 700. 

Following the outer loop decision on the unfailed status of the 
roll rate gyros, the time trigger for the pitch rate gyro is given, 
and the RK and TK QSPRT and SPRT calculations are initiated. As in 
the case of the roll rate gyro, the figure indicates that the RK 
residuals for pitch rate gyro 1 contain no ramping term, while the 

residuals for pitch rate gyro 2 contain a ramp due to the bias present 

in that instrument. Note that the slope of the RK residual ramp for 
pitch rate gyro 2 is smaller than that for roll rate gyro 2, reflecting 
the smaller BFM for the pitch rate gyros. Variables 6-10 in the figure 
indicate quantities associated with TK analytic redundancy which are 
unavailable for the roll rate gyros but are available for the pitch 
and yaw rate gyros. We note that there are ramps in the TK residuals 
for both pitch rate gyros. These residuals are the normal component 
of the air-relative velocity as computed from air data minus the open 
loop estimate obtained from Eq. (3.7) . Thus the ramp in the TK 
residuals for pitch rate gyro 1 is due to the effect of the bias in 

normal accelerometer 2, which is being averaged with normal accelero- 

meter 1 for use in Eq. (3.7). The ramp in the residual for pitch rate 
gyro 2 has a larger magnitude slope than that for instrument 1 because 
the sign of the effect of its bias in the Coriolis term in Eq. (3.7) 
is the same as the sign of the bias in normal accelerometer 2. 

After the TK ETL for the pitch rate gyros of 38 seconds, the 
outer loop makes a decision concerning the status of the pitch rate 
gyros. The RK and TK QSPRT' s are both below -9.2, indicating that both 
tests are good. Also, the TK and RK SPRT's for both instruments are 
positive, and thus no failure is indicated. 

It is instructive to note that at the time the RK QSPRT crosses 
below the -9.2 threshold, the RK SPRT for pitch rate gyro 2 is also 
below -9.2. If the decision logic used following a redundancy trigger, 
given in Section 6.2, were applied at this time, pitch rate gyro 2 would 
be incorrectly identified as failed. This problem arises because the 
QSPRT has no direct redundancy information available following the 
time trigger and assumes the presence of a failure of size BFM in its 
calculation. In particular, if the QSPRT had correctly assumed a 
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0.4 BFM bias in its calculations, it would not have crossed the -9.2 
boundary before the SPRT for pitch rate gyro 2 had crossed the +9.2 
boundary. In order to avoid the identification of a moderately biased 
instrument as failed on a time trigger, the logic of Section 6.3 is 
adopted. This logic extends the identification time and exploits the 
fact that the QSPRT is the WCF for a BFM-sized failure and therefore 
should be greater than the SPRT calculated using the failed sensor. 

Following the outer loop decision on the unfailed status of the 
pitch rate gyros, the time trigger for the yaw rate gyros is given. 

The RK residuals for the yaw rate gyros are similar to those for the 
pitch rate gyros , with those for instrument 2 having an obvious ramp 
component. However, there is a notable difference in the TK residuals, 
which for the yaw rate gyros consist of the difference between the 
lateral component of the air-relative velocity as computed from air 
data minus the open loop estimate. In particular the TK residuals 
for biased instrument 2 have no observable ramp component. The reason 
for this is that the effect of the bias in yaw rate gyro 2 essentially 
cancels the effect of the bias in lateral accelerometer 2. The ramp 
in the residuals for yaw rate gyro 1 is due to the additive effects of 
the biases in roll attitude gyro 2 and lateral accelerometer 2. When 
the TK ETL of 38 seconds is reached, the RK and TK QSPRT' s and SPRT's 
are examined by the outer loop. Both the RK and TK QSPRT ' s are below 
-9.2, indicating that both tests are good. Since the RK and TK SPRT's 
for both instruments are positive, no failure is indicated. 

The simulation of the rate gyro time triggers in thunderstorm 
turbulence is shown on the right side of Figure 7-1. Again, the order 
of the time triggers is roll, pitch and then yaw. The roll rate gyro 
time trigger runs for 11 seconds, the RK ETL, and then a failure status 
decision is made for those instruments. Following this decision, the 
pitch rate gyro time trigger is initiated. Because the turbulence 
estimator described in Appendix A correctly indicates a high turbulence 
level , the smaller TK SPRT gains are used together with the high 
turbulence ETL of 55 seconds. Thus a failure decision is made for the 
pitch rate gyro at t=66 sec, after which the time trigger for the yaw 
gyros is initiated. Again the smaller TK SPRT gains and larger TK 
ETL are used, and a failure status decision for the yaw rate gyros is 
made at t=121 sec. 
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Examination of the figure indicates the RK QSPRT, residuals and 
SPRT's for the roll rate gyros are virtually identical to those obtained 
in the absence of turbulence. At t=ll sec, the outer loop examines the 
RK QSPRT and SPRT's. Although the RK QSPRT is negative indicating a 
good test, the RK SPRT's for both instruments are positive, and there- 
fore no failure indication is given for the roll rate gyros. 

At t=ll sec, the time trigger for the pitch rate gyros is 
initiated. As in the case of no turbulence, the RK residuals for 
instrument 1 have no appreciable bias, while the RK residuals for 
instrument 2 have a bias of slope 0.4 BFM. The RK SPRT's become positive 
more quickly than in the no turbulence case due to some "beneficial" 
maneuver-dependent errors introduced by the turbulence. The TK QSPRT 
goes initially positive at a slower rate than before due to the smaller, 
high turbulence gain. The TK QSPRT remains positive longer than before 
because of the assumption of twice the wind shear profile assumed for 
low turbulence. The TK residuals for the two instruments have, on the 
average, slopes similar to the no turbulence case, but with the addition 
of high amplitude low frequency noise due to the thunderstorm turbulence. 
Beyond t=40 sec, the turbulence keeps the residual for instrument 2 
below the truncation level of -30 m/sec. The TK SPRT's for the two 
instruments remain negative for several seconds due to the low frequency 
wind shears. However because the shears are not sustained, both SPRT's 
eventually cross the no-fail threshold. At t=66 sec, the outer loop 
makes a decision on the failure status of the pitch rate gyros, and 
since both the TK and RK SPRT's for both instruments are positive, no 
failure indication is given. 

At t=66 sec, the time trigger for the yaw rate gyros is initiated. 
Again, the RK variables are quite similar to those obtained in the 
absence of turbulence, while the TK residuals and SPRT's reflect the 
presence of low frequency wind shears in the turbulence. After reaching 
the TK ETL of 55 seconds at t=121 sec, the outer loop examines the yaw 
rate gyro QSPRT 's and SPRT's. Because both the TK and RK SPRT’s for 
both instruments are positive, no failure indication is given. 

7.2.2 Accelerometers 

Time triggers were run for the accelerometers and air data 
sensors in the same two turbulence environments used for the rate gyro 
simulations. Again, +0.4 BFM biases were present on the number 2 
instrument of every type. As in the case of the rate gyros the 
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simulations without turbulence presented no surprises, and 
those results will not be discussed here. 

Results of simulation of time triggers for the accelerometers 
in thunderstorm turbulence are presented in Figure 7-2. Only the most 
powerful form of analytic redundancy for each particular instrument type 
is presented, i.e., translational kinematics for longitudinal acceler- 
ometers (x) , translational dynamics (TD) for lateral accelerometers (y) and 
altitude kinematics (AK) for normal accelerometers ( 2 ) . The present outer 
loop logic uses only these principal tests for provisional failure identi- 
fication following accelerometer time triggers. However, the time 
waited until a decision is made is the longest ETL of the three analytic 
redundancy types, which is the high turbulence TK ETL for each of the 
accelerometers: 67 seconds for x and 53 seconds for y and z. 

The left column in Figure 7-2 gives the time trigger results 
using translational kinematics for the longitudinal accelerometers. The 
TK QSPRT exhibits the same behavior as the high turbulence pitch and 
yaw rate gyro results shown in Figure 7-1. The TK residuals for 
instrument 1 are essentially zero mean with low frequency noise due to 
turbulence, while the residuals for instrument 2 contain a ramp of 
slope 0.4 BFM. The SPRT for instrument 1 crosses the no-fail boundary 
at t=20 sec and remains above the boundary for the duration of the 
time trigger. The combined effects of the high turbulence and the 
bias on the number 2 accelerometer cause its SPRT to remain negative, 
but above the failure threshold of -9.2, for nearly the entire run. 

At the TK ETL of 67 seconds, the SPRT 1 s for both instruments are 
above the failure threshold, and no failure is indicated by the outer 
loop . 

The center column of Figure 7-2 gives the time trigger results 
using translational dynamics for the lateral accelerometers. The TD 
QSPRT crosses the negative threshold at t=l sec and remains below the 
threshold for the rest of the simulation. This indicates that the 
effect of table error is less than the effect of a lateral accelero- 
meter BFM failure throughout the simulation. The two lateral TD 
residuals are shaped nearly the same, reflecting the high turbulence 

present. However, the residuals for instrument 2 have a positive bias 
2 

of about 1 m/sec due to the bias on that instrument. The TD SPRT for 
instrument 1 crosses the no-fail threshold at t=l sec and remains 
above that level, while the TD SPRT for instrument 2 oscillates 
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TIME (seconds) 


Figure 7-2 Accelerometer Tim? -Trigger Performance 







initially but remains above the no-fail threshold following t=5 sec. 

At the lateral accelerometer TK ETL of 53 seconds, the outer loop 
examines the TD QSPRT and SPRT ' s and indicates no failure is present. 

The right column of Figure 7-2 gives the time trigger results 
using altitude kinematics for the normal accelerometers. The AK QSPRT 
starts off positive due to worst case initialization errors in estimated 
altitude and altitude rate. However, the quadratic effect of the 
assumed accelerometer BFM failure soon dominates, and the QSPRT crosses 
the failure threshold after about 9 seconds and remains below that 
level to the end of the run. The AK residual for instrument 1 grows 
quadratically due to the combined effects on the open loop altitude 

estimate of the biases in the number 2 lateral and longitudinal 

* 

accelerometers . The AK residuals for instrument 2 also grow quadra- 
tically, but much faster due to the bias present in that instrument. 

The AK SPRT 1 s reflect this residual behavior, with the SPRT for 
instrument 1 remaining below the no-fail threshold until t=5 sec and 
the SPRT for instrument 2 remaining below the no-fail threshold until 
t=13 sec. At the normal accelerometer TK ETL of 53 seconds, the outer 
loop examines the AK QSPRT and SPRT's and determines that no failure 
is present. 

7.2.3 Mach Meters and Alpha Vanes 

Results of simulation in thunderstorm turbulence of time triggers 
for the Mach meters and alpha vanes are presented in Figure 7-3. Because 
only the residuals for translational dynamics are observable 
for all time following a bias failure, the outer loop uses only the TD 
QSPRT and SPRT in its failure decisions for these instruments. The 
left column of Figure 7-3 shows the time trigger results for the Mach 
meters, while the right column gives these results for the alpha vanes. 

As described in Section 4.6 there are two residuals for each instrument, 
one in the longitudinal direction and one in the normal direction. 

These residuals are the second through the fifth variables shown in 
Figure 7-3. 

Observing the Mach meter results in the left column, the TD 
QSPRT crosses the negative threshold in 1 second and remains below that 
* 

Note that the aircraft is no longer at zero bank angle because of 
the effects of turbulence. 
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level for the rest of the run. The x and z residuals for instrument 1 
are quite noisy, reflecting the high turbulence level. In addition, 
both residuals are biased due to the combined effects of the biases on 
the number 2 accelerometers and alpha vane. The residuals for the 
number 2 Mach meter are similar in shape to those of instrument 1 but 
biased even more due to the presence of the 0.4 BFM bias on Mach 
meter 2. These biases are much smaller than expected by the SPRT's, 
however, since they are looking for the effects of a Mach bias of 0.23. 
Thus, both SPRT's cross the no-fail threshold within 2 seconds, and 
remain above that level to the end of the run. After the Mach meter 
TD ETL of 18 seconds, the outer loop examines the TD OSPRT and SPRT's 
and determines that no failure has occurred. 

The results for the alpha vanes are shown in the right column 
of Figure 7-3. The TD QSPRT crosses the negative threshold after 
3 seconds, and remains below that level. The x residuals for instrument 1 
and 2 are essentially identical, indicating the insensitivity of this 
channel to alpha vane bias. There is a low frequency drift in the alpha 
vane x residuals not present in the Mach meter residuals due to a 
different turbulence sequence in the alpha vane simulation. The low 
frequency shape of the z residuals are similar for alpha vanes 1 and 
2, reflecting the effects of turbulence, but the residual bias for 
instrument 2 is of higher magnitude than that for instrument 1 due to 
the bias on alpha vane 2 . Note that the magnitude of the high frequency 
noise on the alpha vane z residuals is larger than that of the Mach 
meter z residuals due to the fact that the average of the two alpha 
vanes is used to compute the residuals for the Mach meters. The 
converse effect on the x residuals is much less obvious due to the 
scaling of the plots. The TD SPRT for alpha vane 1 crosses the no-fail 
threshold at 2 seconds and remains above that level. However, the 
TD SPRT for alpha vane 2, following the effect of the instrument bias 
and the low frequency wind shear, crosses the failure threshold at 
t=3 sec and remains below that level until t=14 sec. It then crosses 
the no-fail threshold two seconds later. At the alpha vane TD ETL of 
16 seconds, the outer loop examines the TD QSPRT and SPRT's and 
determines that no failure has occurred. However, the large amount of 
time during which the SPRT for alpha vane 2 remains below the failure 
threshold does indicate a high probability of provisionally failing, 
after a time trigger, an alpha vane with a bias of smaller magnitude 
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than half the present BFM. If this were to create a problem in an 
operational environment, it could be alleviated by raising the alpha 
vane BFM, since the problem stems from the relative effects of an alpha 
BFM failure versus the error in the TD test due to other instrument 
biases and table errors. An increase in the alpha vane BFM will not 
require increasing the BFM's of any other instrument since alpha does 
not have a first order effect in the primary tests of the other 
instruments . 

7 . 3 Redundancy Trigger Performance 

The direct redundancy trigger and subsequent identification 
logic for each instrument type was tested in a moderate turbulence 
environment with rms winds of 1.2 m/s. In each case, the number 2 
instrument of every type contained a bias of +0.4 BFM, while the number 1 
instrument of every type other than the one being tested contained no 
bias. The test for each instrument type was initiated by inserting a 
failure bias of size -BFM on the number 1 instrument. 

7.3.1 Rate Gyros 

The results for the rate gyros are shown in Figure 7-4. Only 
the direct redundancy (DR) SPRT and the RK QSPRT , RK residuals and 
RK SPRT are given since DR and RK are the primary tests for these 
instruments. The left column gives the results for the roll rate gyros, 
the center column the results for the pitch rate gyros, and the right 
column the results for the yaw rate gyros. The time at which detection 
occurs can be seen as the time at which the DR SPRT changes from zero. 
These detection times are .25 seconds for roll and .19 seconds for 
pitch and yaw. For all three instrument types the DR SPRT immediately 
confirms the presence of a failure. Correct identification occurs when 
the RK QSPRT crosses the failure threshold, since by that time the 
RK SPRT for instrument 1 is both below the failure threshold and below 
the RK SPRT for instrument 2. These failure identification times are 

2.3 seconds after the failure for the roll rate gyros, 7.3 seconds for 
the pitch rate gyros and 8.1 seconds for the yaw rate gyros. 

7.3.2 Accelerometers 

The results for the accelerometers are given in Figure 7-5. As 
in Figure 7-2, only the quantities associated with the primary test 
for each accelerometer type are given: TK for the longitudinal 

accelerometers, TD for the lateral accelerometers and AK for the 
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normal accelerometers. In addition the DR SPRT’s for the three 
accelerometer types are also given as the first quantity plotted for 
each instrument. The times at which the BFM-sized failures are detected 
are 1 second for the longitudinal accelerometers, 0.38 seconds for the 
lateral accelerometers and 0,69 seconds for the normal accelerometers. 

The times at which the number 1 instrument of each type are correctly 
identified as failed are 14.5 seconds for longitudinal accelerometer 1, 
1.25 seconds for lateral accelerometer 1 and 6.38. seconds for normal 
accelerometer 1. Identification for the longitudinal and normal 
accelerometers occurs when the QSPRT crosses the failure threshold, 
since by that time the SPRT for instrument 1 is both below the SPRT for 
instrument 2 and below the failure threshold. Because of a particularly 
bad sequence of beta vane noise the TD SPRT for lateral accelerometer 1 
crosses the failure threshold after the TD QSPRT. Thus correct 
identification of lateral accelerometer 1 is delayed until its TD SPRT 
crosses the failure threshold approximately 0.38 seconds after the TD 
QSPRT crossing. 

7.3.3 Mach Meters and Alpha Vanes 

Simulations of -BFM failures on the number 1 Mach meter and 

alpha vane were made, and the results for the alpha vanes are given in 

Figure 7-6. Before discussing this figure, we will summarize the 

results for the Mach meters. No figure is given for the Mach meters 

because failure identification is made at the time of failure detection, 

using the window of stored TK residuals as described in Section 4.7.7. 

Correct identification of the failure of Mach meter 1 occurs 0.25 seconds 

* 

after failure injection. 

In the alpha vane results shown in Figure 7-6, the same quantities 
are plotted as in Figure 7-3, with the addition of the alpha vane DR 

SPRT. The failure of an alpha vane is detected at 1.2 seconds, the 

DR SPRT immediately confirms the presence of the failure, and the 
failure of alpha vane 1 is correctly identified at 2.3 seconds. In 

this case the TD SPRT for instrument 1 crosses the failure threshold 

after the TD QSPRT because of the additive effects of the actual Mach 
bias and table errors, which are RSS'd in calculating 'the QSPRT. 
Modification of the QSPRT calculations so that all error effects are 
summed will remove this possibly troublesome situation. 

* 

This number represents CSDL simulation only, since time constraints 
prevented including the Mach meter TK SPRT's in the Langley 
simulation . 
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7.3.4 Attitude Gyros, Altimeters 


As with the Mach meters, failure identification for the attitude 
gyros and altimeters is accomplished by first using as inputs to the 
SPRT's the window of stored residuals. If there is not enough informa- 
tion in this window of residuals to make an identification, additional 
residuals are processed sequentially after failure detection. Because 
in these simulations at most three additional samples after detection 
were required for identification, the strip chart recordings are quite 
•short and difficult to read. Therefore no figure will be presented for 
the attitude gyros. The results are summarized in Table III. 


Table III Attitude Gyro and Altimeter Simulation Results 


Instrument Type 

Detection Time (sec) 

Identification Time (sec) 

<t> 

1.5 

1.5 

0 

1.375 

1.5625 


1.375 

1.5 

* h 

1.125 

1.1875 


7 . 4 Hard Failure Identification 

In addition to the BFM failure simulations described above, 
larger bias failures were simulated for the rate gyros and accelerometers. 
The simulation included thunderstorm turbulence and +0.4 BFM biases on 
instrument 2 of every type. The inserted biases were -ig on the number 1 
accelerometers and -0.1 rad/sec on the number 1 rate gyros. The 
results are summarized in Table IV. In all cases the number 1 instrument 
was correctly identified as failed. The times given in the table are 
the time from failure injection to the given event. 

We note that the failed normal accelerometer is not provisionally 
failed or identified as failed for three seconds. Because the instru- 
ment outputs are being averaged for use in the autopilot, this means 
that an erroneous l/4g acceleration signal will be fed to the autopilot. 

It is important to note that the thunderstorm turbulence subjects the 
aircraft to l/3g normal accelerations for as long as ten seconds. Thus, 
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Table IV Hard Failure Simulation Results 


Instrument 

Detection (sec) 

Provisional Failure (sec) 

Failure Identification (sec) 

a 

0.25 


0.9375 

X 




a 

0.1875 

0.1875 

0.3125 

y 




a 

0.1875 


3.0 

z 




p 

0.125 

0.625 

0.875 

q 

0.0625 

0.4375 

1.125 

r 

0.125 

0.625 

1.1875 


the erroneous l/4g signal for 3 seconds should not adversely affect 
a control system designed to perform well in thunderstorm turbulence. 

In the absence of high turbulence, the translational dynamics test 
will quickly provisionally fail the bad accelerometer, removing it from 
autopilot calculations. 


90 



SECTION 8 


APPLICATION TO FLIGHT TEST DATA 


8.1 Introduction 

In this section we report the results of application of the FDI 
algorithm outlined in the previous sections to several segments of 
telemetry data from the flight of the F-8 DFBW aircraft. Differences 
between the assumed and observed instrument characteristics require 
some changes to the previously chosen FDI system parameters. However, 
the basic framework of the FDI algorithm is found Sufficiently flexible 
that only minimal modifications are required to achieve good performance 
in finding failures superimposed on the flight data. 


8 . 2 Discussion of Flight Data 

Nine segments of flight data were provided by the NASA Dryden 
Flight Research Center for FDI algorithm analysis. The starting times 
and duration of these segments are given in Table V. 

Table V Flight Data Segment Times 


Segment 

Starting Time 
(hr/min/sec) 

Approximate Duration 
(sec) 

1 

9/47/27.064 

53 

2 

9/54/ 7.124 

66 

3 

9/57/ 9.24 

51 

4A 

9/59/ 2.042 

38 

4B 

10/01/ 0.042 

180 

4C 

10/04/15.026 

45 

4D 

10/05/16.065 

14 

5 

10/08/36.002 

24 

6 

10/21/ 0.004 

70 
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For each segment, the outputs of two instruments are available for 
all redundant sensor types except altimeter, for which only one instru- 
ment output is provided for this study. In addition, nonredundant 
measurements of sideslip angle, elevator position, rudder position 
and aileron position are also available. Time histories of these 
variables are shown for the nine flight segments in Fig. 8-1 through 
8-18. In all of these figures, the rate gyro output is in rad/sec, 
the attitude gyro output is in radians, the accelerometer output is 
in m/sec , the alpha and beta vane outputs are in radians, the 
control surface positions are in degrees and the altimeter output is 
in meters. Numerical scaling of a dependent or independent variable 
is indicated by parentheses after the variable name enclosing the letter 
"E" followed by a signed integer. For example, a dependent variable 
name followed by " (E+2)" indicates that the ordinate value should be 
multiplied by 100 to obtain the value of the variable. We note that 
oh this flight no automatic control loops are active and therefore 
the control surface positions reflect only pilot input. 

Segment 1 includes the takeoff roll, liftoff and climbout 
to 600 m altitude. The engine afterburner is ignited at 2 sec and 
turned off at 39 sec. The F-8, which was an operational carrier-based 
Navy aircraft, was designed with a variable incidence wing. The wing 
is raised for takeoff and landing to decrease the required aircraft 
speed and pitch attitude angle. The transition from wing up to wing 

down, the standard flight position, may be seen by the dip in measured 

* 

alpha from 24 to 34 seconds into Segment 1. 

For the first 36 seconds of Segment 1, the two Mach meters 
read appreciably different values. This is due to characteristics 
of the instruments which render them inoperative below Mach numbers 
of approximately 0.4. Also, there is a significant bias between the 
readings of the two yaw attitude gyros. This is to be expected, 
since the two instruments are independent and are not initialized to 
any reference azimuth. Additionally, for the first several seconds 
of segment 1, the alpha and beta vanes are erroneous due to insufficient 
dynamic pressure. 


The alpha and beta vanes are mounted on a boom extending from the 
nose of the aircraft, and measure the orientation of the aircraft 
air-relative velocity with respect to the aircraft body axes at that 
position . 
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It is important to note that the telemetry data shown in the 
figures are less accurate than the instrument outputs which are available 
to the aircraft computers. In particular, before telemetry the 
instrument outputs are first passed through analog signal conditioners, 
dedicated to each instrument, and then quantized. The instrument 
quantization levels for telemetry are at least four times the levels 
for the aircraft computers shown in Table I. By far the worst quantization 
degradation occurs in the altimeter output which is quantized at 30m 
for telemetry, compared to 3.4m for the aircraft computer. In addition 
to the quantization increase in the telemetry data, comparison of the 
telemetry data with flight tape recordings of the instrument outputs 
used in the aircraft computers has revealed faulty signal conditioners 
for at least two of the instruments. Note that the negative peaks 
for yaw rate gyro 1 are less pronounced than the negative peaks for 
yaw rate gyro 2, resulting from a negative scale factor of less than 
unit magnitude for the signal conditioner of yaw rate gyro 1. Ad- 
ditionally, the signal conditioner for longitudinal accelerometer 1 
has a higher damping coefficient than that for longitudinal accelero- 
meter 2, resulting in less pronounced peaks and longer response times 
for instrument 1 relative to instrument 2. 

Segment 2 is at 6.15 km altitude at Mach 0.42. During this 
segment there are elevator, aileron and rudder pulse and doublet 
commands, but the aircraft on the average is flying wings level. 

We mention here that a plot of a v versus 6 for this segment 
indicates a value of C ^ approximately 0.5 times the value used for 
this flight condition in the simulations available at the Langley 
Research Center 

Segment 3 is similar to segment 2 but nearer the design 
flight condition at Mach 0.63 and 6 . 1 km altitude. Again there are 
several pulse and doublet control surface commands, with the aircraft 
very nearly trimmed for horizontal flight. 

In segment 4A, the aircraft is at about the same airspeed and 
altitude as segment 3 but is in a turn with a roll angle of approximately 
-1.1 radians. Again several control surface pulses and doublets are 
present. Both the Mach number and altitude decrease as the aircraft 
changes heading. Note the time- varying difference between the two 
yaw attitude gyros. This is due to the time-varying difference 
in turn error for each of these directional gyros (DG's) . A 
detailed explanation of turn error is given in Ref. 9 and 
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Appendix F. Here we simply note that the turn error for each DG 
c , may be approximated by 


c 



0 ) sin 2ip 


( 8 . 1 ) 


where is the aximuth angle between the aircraft roll axis and the 
angular momentum vector of the DG . Since the two DG's are not aligned, 
there is a difference between the turn errors for the two instruments, 
and in a banked turn this difference is time varying. 

Segment 4B shows the aircraft at an average altitude of 6.4 
km with increasing airspeed through Mach 1. At 115 seconds the 
ignition of the engine afterburner can be seen as a jump in the longitu- 
dinal accelerometer readings. At 130 seconds the aircraft breaks the 
speed of sound. At that time, large jumps occur in the outputs of the 
Mach meters, alpha vanes and in the barometric altimeter. These jumps 
are fictitious relative to the true aircraft state, and in fact these 
instrument types are in error from a time of about 100 seconds until 
after the speed of sound crossing. These errors are associated with 
shock induced local air flow variations which are present in the 
transonic flight regime. In addition, at supersonic speeds the alpha 
vane is biased by approximately +0.02 rad due to interaction with the 
shock wave formed at the tip of the air data boom. Clearly, the TK, 

TD and AK analytic redundancy tests will have test errors during the 
transonic region associated with the fictitious behavior of the air 
data sensors. In Section 8.4.2 we discuss the adaptation of the FDI 
algorithm to take these errors into account. 

In segments 4C and 4D, the aircraft is oscillating in Mach 
number and altitude. Allowing for the sixteen second gap between the 
two segments, the time histories of Mach and altitude after the elevator 
spike at 11 seconds into segment 4C suggest excitation of the phugoid 
mode of the aircraft. The latter part of segment 4C contains the highest 
dynamic pressure encountered in the telemetry data. 

For the first part of segment 5, the aircraft is at Mach 1.24 
at an altitude of 12.2 km. After 16.2 seconds, the engine afterburner 
is turned off, and the airspeed begins decreasing. At 19.4 seconds 
the failure of one of the onboard computers results in loss of the 
altimeter data. Note that nearly twice the bias that existed in 
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earlier segments between the two roll angle measurements is present in 
segment 5. We also observe that between the end of segment 4D and the 
beginning of segment 5, a time of approximately 3 1/2 minutes, the yaw 
attitude has changed by about 2.7 radians. If we hypothesize that 
a long, shallow turn was carried out in this time interval, the increased 
bias between the roll attitude measurements may be explained by vertical 
gyro drift during erection cutout . 

The vertical gyro (VG) is a two degree of ffeedom gyro with its 

spin axis slaved by a torque motor to a highly damped pendulum. In 

unaccelerated flight, the gimbal angles are therefore equal to the roll 

and pitch Euler angles. However, during long periods, of longitudinal 

or lateral acceleration, the pendulum moves from alignment with the 

gravity vector to alignment with the specific force vector, and if 

the spin axis is slaved to the pendulum the gimbal angles will no 

longer correspond to roll and pitch angles. Thus it is desirable to 

remove the slaving of the gyro to the pendulum in the presence of 

acceleration. In most VG's, the question of longitudinal acceleration 

is ignored, but lateral acceleration is deduced by the presence of a 

sustained yaw rate. In the instruments aboard this aircraft, each 

vertical gyro has a self-contained yaw rate gyro whose output is fed 

through a first order low-pass filter with a time constant of 15 seconds. 

If the magnitude of this filtered output is greater than 0.0044 rad/ 

sec, the roll slaving torque to the gyro is set to zero. When this 

erection cutout occurs, the roll angle measurements are degraded in 

time by the drift rates of the VG, which are specified to be no higher 

than 7.2 x 10 5 rad/sec per axis. During erection, the erection rate 

— 4 —4 

is required to be between 2.3 x 10 and 5.2 * 10 rad/sec. Later 
we will discuss possible incorporation of erection cutout logic into 
the FDI algorithm. 

Segment 6 includes the aircraft touchdown at approximately 
57 seconds. Altitude and Mach data are unavailable. The wing is 
raised throughout the entire segment, and moderate turbulence is 
present. 

8 . 3 Calculation of FDI System Parameters 

The groundrule for this study of flight data is that with the 
exception of the altimeter in segments 5 and 6, the telemetry data 
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should be considered as coining from unfailed instruments. • Thus the FDI 
algorithm must be modified to give good performance when applied to the 
telemetry data; in particular there should be no direct redundancy 
triggers or false identifications on time triggers over the nine segments. 

As a first step in the modification process, the differences in 
the outputs of the redundant instrument pairs are examined to determine 
the means and variances of the differences over one second windows. 

Recall from Section 4.3.1 that the direct redundancy threshold is set 
at 0.75 BFM. Thus the worst-case mean values establish minimum BRm 
sizes in that there will be no direct redundancy trigger on any in- 
strument if the BFM for each instrument type is greater than four- 
thirds its worst case mean difference. Additionally, the variance 
of the instrument differences may be considered to be an estimate of 
twice the individual instrument variance. The calculated values for 
the minimum BFM's and estimated sensor noise standard deviations are 
given in Table VI. Note that there is no minimum BFM given for the 
DG's. In order to compensate the DG output for turn error it is 
necessary to know the angle between the spin vector of the instrument 
and the roll axis of the aircraft when the instrument reading is zero. 

With this information, it is possible to remove turn error from each of 
the instruments and run a direct redundancy trigger on the directional 
gyros. Unfortunately, this calibration information is not directly 
available and must be inferred from the noisy instrument outputs during 
maneuvers . Because of the preliminary nature of the DG turn error cor- 
rection scheme and the present unavailability of sufficient telemetry 
data to verify the technique, we will not attempt to do FDI for the 
DG's here, and the rate gyro RK QSPRT's will assume nominal DG perfor- 
mance uncompensated for turn error. The question of DG FDI and turn 
error correction is discussed in Appendix F. 

In the remainder of this subsection we will discuss the procedure 
by which the BFM's and ETL's for the various instrument types are 
chosen. Only the primary tests, those capable of identifying a BFM- 
sized failure, will be discussed. The calculation of B and ETL 
values for the secondary tests is straightforward. 

8.3.1 Attitude Rate Gyros 

In the case of the rate gyros, the BFM's are established by 
examination of time trigger RK residuals for the various segments. 
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Table VI Minimum BFM and Standard Deviation Data 


Instrument 

Type 

Minimum 

BFM 

Standard 

Deviation 

Mach 

.01 

.0023 

a (rad) 

.011 

.005 

a x (m/sec 2 ) 

2.0 

.23 

a (m/sec 2 ) 

.08 

.043 

Y , 



a^ (m/sec z ) 

.88 

. 289 

p (rad/sec) 

.053 

.005 

q (rad/sec) 

.032 

.002 

r (rad/sec) 

.029 

.002 

ip (rad) 

. 08 

.005 

9 (rad) 

.037 

.0019 

ip (rad) 


.005 

6 (rad) 


.005 


The BFM values are chosen to be double the worst case bias present 
on the instruments implied by the RK residuals. In this way, BFM 
values of 0.062 rad/sec for p and 0.04 rad/sec for q and r are 
selected. In order to calculate the RK ETL ’ s for the rate gyros, 
we assume attitude gyro noise standard deviations of 0.005 rad 
for ij) and ip and 0.002 rad for 6. The derivation follows the 
development of Section 4.2, except that the initialization now 
is done using raw angle measurements instead of the filtered estimates 
used before. Because of the increased unfailed rate gyro biases 
compared to the decreased attitude gyro noise, the bias in the 
filtered attitude estimate due to a BFM/ 2 bias on an unfailed rate 
gyro plus three times the standard deviation of the filtered estimate 
is now larger than three times the raw attitude ' measurement standard 
deviation. So we assume an initial attitude bias b of 0.015 rad 
for p and r and 0.006 rad for q. Since our sample period must be 
a multiple of the telemetry sample period of 20 msec, we choose 

a sample period T of 0.06 sec. Substituting these values and the 
2 

BFM and a numbers mentioned above into Eq. (4.3) gives T m values 
of 1.8 sec for p, 2.1 sec for q and 2.8 sec for r. In the past we 
have chosen the RK ETL's to be 1.5 times T . However, in the case 
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of the attitude rate gyros we note that substantial attitude error 
in the RK test may occur due to turn error in the directional gyros. 

In order to allow the signature of a BFM rate gyro bias, which is 
proportional to time, to exceed this test error, we set the RK ETL's 
for all three rate gyros to 40 sec. Additionally the turn error 
contribution to total test error is added to the rate gyro RK 
QSPRT's. This will be discussed in Section 8.4 together with other 
program modifications. 

8.3.2 Vertical Gyros 

The choice of BFM for the vertical gyros is made simple by the 

fact that there are no time triggers for these instruments . Thus 

we may choose the BFM's on the basis of Table VI only, and we choose 

the BFM to be 0.08 rad for <f> and 0.037 rad for 9. Using Eq. (4.8) 

to find x , the mean time to detect, we obtain values of 0.18 sec 
m 

for <(> and 0.12 sec for 0, where these numbers have been rounded to 
the next highest multiple of the sample period. Thus the T m /3 
term in Eq. (4.6) will be 0.06 for both <j> and 9, since it must 
be an integral factor of the sample period T. We choose the initial 
attitude error to be the sum of the bias due to a BFM/2 bias in the 
corresponding rate measurement plus three times the standard deviation 
of the estimation error. These figures are: 

M, = 0.021 rad 

<P 

M. = 0.012 rad 

U 

Substituting these values into Eq. (4.8) results in ETL's of 0.29 
sec for <p and 0.42 sec for 0. 

The mechanism of vertical gyro erection cutout was described 
earlier. The minimum BFM level for <p in Table VI is required 
for segment 5, which follows a period of erection cutout. A value 
20% lower could be used over the other flight segments. In order 
to attain maximum performance during erection, BFM logic for <p 
could be implemented using a filtered estimate of yaw rate from 
the yaw rate gyros analogous to the signal used by the vertical gyro. 
Two BFM levels for roll attitude would be used, with the 
calculated BFM value always lying between the two levels. The 
BFM calculation would proceed as follows: during erection 

the calculated BFM level would go toward (but not below) the lower 
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level at the erection rate, and during erection cutout the calculated 
BFM level would go toward (but not above) the higher level at the 
maximum specified drift rate. Unfortunately, this technique is 
impractical for use with the telemetry segments. Because the minimum 
BFM level for the yaw rate gyros is more than three times the level 
for erection cutout, the biased yaw rate instruments will tend to 
keep the <t> BFM at its higher level. On the other hand, the 
poor yaw rate gyro behavior in the telemetry data appears to be 
due to a faulty analog signal conditioner and not to the instruments 
themselves. Thus the FDI algorithm for onboard tests might utilize 
a yaw rate gyro BFM which is low enough to make this vertical gyro 
variable BFM scheme workable. 

8.3.3 Accelerometers 

Recall that the primary test for the longitudinal accelerometers 

2 

is TK. We will set the a BFM at 2m/sec and assume a measurement 
. . x 2 

noise standard deviation of 0.3m/sec consistent with the corresponding 

2 

figures in Table VI. Using the values for T q and a assumed in 
Section 4.4.2, the new TK ETL ' s are calculated to be 32 sec for 
low turbulence and 48 sec for high turbulence. We note that 
because throttle position and afterburner information are unavailable 
on the aircraft, TD is not available for the longitudinal accelerometer. 

The primary test for the lateral accelerometer is TD. Although 
the fact that the dynamic effect of sideslip angle was observed to be 
approximately half the assumed value allows the worst-case table 
bias coefficients for the lateral channel in Table B.l to be reduced 
from 0.65 to 0.3, we will retain the lateral accelerometer BFM 
2 

at 2m/sec since no lower level can be identified throughout the 
flight envelope. We also extend the TD ETL to 20 seconds to allow 
for the larger test error assumed from table error and beta vane 
bias at high Mach numbers . Because of the extremely large q and r 
BFM levels dictated by the telemetry data, TK is essentially useless 
for failure identification for the lateral and normal accelerometers. 

The primary test for the normal accelerometers is AK. We 

2 

again choose the BFM to be 1.5m/sec . Because of the large altitude 

quantization, the values of e and M used in Section 4.7.6 are raised 

2 

to 3 m/sec and 21 m respectively. Also a , the variance of the altitude 

2 

measurements, is raised to 147 m . Substitution of these values 
into Eq. (4.23) gives an AK ETL of 47 sec. 
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The BFM and ETL values for the accelerometers derived above 
produced no false failure identifications during time triggers 
run over the nine telemetry segments. However, in order to avoid 
false identifications in the transonic region, the QSPRT's for some 
of the tests must be modified to accomodate anomolous air data 
sensor behavior observed in segment 4B. These modifications will 
be discussed in Section 8.4. 

8.3.4 Mach Meters and Alpha Vanes 

The primary test for the Mach meters is TK, and we follow 
the development of Section 4.7.7. For practical considerations, 
the BFM and ETL derived for the high turbulence case are used 
in both the high and low turbulence situations. Because of the 
decreased Mach noise, we have 

v = 9 x 10“ 6 

M = 1.21 m/sec 

We assume a conservative high turbulence wind shear of 

2 

b = 5.0 m/sec 

and a test variance equal to the 99% Dryden wind level: 

? 2 2 
a = 30 m /sec 

We choose a Mach BFM of 

B = 0.045 -M 

which is essentially the minimum detectable value given these 
parameter choices. Solving Eq. (4.24) gives a Mach TK ETL of 
0.6 sec. 

The primary test for the alpha vanes is TD. The development 

of Section 4.6 is somewhat simplified by the fact that only the 

z-direction is available due to the lack of throttle information. 

2 

We assume a z acceleration measurement error of 0.75 m/sec , and 
from Appendix B a table error at the design flight condition of 
0.53 m/sec 2 . We also assume two errors arising from a Mach bias 
of BFM//2’’ : the error in calculated dynamic pressure of 0.52 
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2 2 
m/sec and the table error due to Mach error of 0.69 m/sec . The 

_ 2 

RSS of these four errors gives a test error b of 1.26 m/sec at 
the design flight condition, which translates to a minimum alpha 
BFM of 0.0137 rad. Because of the rather tenuous behavior of 
the alpha vane TD in thunderstorm simulations, as discussed in 

Section 7, we have slowed the test by choosing an artificially 

2 2 4 

high value of the test variance a of 40 m /sec . We choose the 
alpha vane BFM to be 

B = 0.025 rad 

which is nearly 50% higher than before, and we calculate T c to 
be 4.7 sec with a resulting TD ETL of 7 sec. 

8.3.5 Summary 

The BFM levels chosen for the dual redundant instruments 
available on the telemetry data are shown in Table VII. As mentioned 
earlier, on this flight insufficient data is available to allow 
low-level bias identification for the DG's and only a single altimeter 
output is provided. 


Table VII New BFM Levels 


Sensor Type 

BFM 


2.0 m/sec 

x y 


a 

z 

1.5 m/sec 2 

p 

0.062 rad/sec 

q/r 

0.04 rad/sec 

<f> 

0.08 rad 

9 

0.037 rad 

Mach 

0.045 

a 

0.025 rad 
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8.4 FDI Algorithm Modifications 

In this subsection we discuss some modifications to the FDI 
algorithm to incorporate previously unmodeled sensor behavior which 
is revealed in the telemetry data. 

8.4.1 Mach Filter and Translational Test Delay 

A 0.5 sec time constant Mach filter has been added to provide 
a clean estimate of Mach number at each sample time. Following a 
time trigger or direct redundancy trigger, the initiation of TK 
and TD tests is delayed until the estimated Mach exceeds a threshold 
value, currently 0.38. This delay in the initiation of translational 
tests is necessary to ensure the accuracy of Mach meter data. 
Additionally the QSPRT for a currently running TK or TD test is 
set to +9.2 when the estimated Mach drops below the threshold. 

8.4.2 Modifications in Transonic Region 

As mentioned in the discussion of telemetry segment 4B, the air 
data sensors behave badly in the transonic region. We define this 
region as the time that the filtered Mach estimate is between 0.91 and 
1.04. Because the exact behavior of the Mach meters and altimeters 
in the transonic region is not known well enough for direct compensa- 
tion, we assume some appropriate worst-case errors in the QSPRT' s 
for those tests using these measurements. Additionally, the alpha 
vanes are biased by approximately 0.02 radians above Mach 1. This 
bias is removed from the alpha vanes for all TK and TD calculations 
at supersonic speeds, and to allow for some correction error the 
worst-case table errors given in Table B.l are increased by 250 mg 
for TD QSPRT calculations. 

The effect of the Mach meter transonic error is essentially 

limited to the TK test in the longitudinal direction. For this 

2 

test the QSPRT includes an acceleration error of 0.77 m/sec during 
the transonic region and a velocity error jump at Mach 1 of 18m/sec. 

The effect of the erroneous altimeter behavior is limited to 
the AK test. The AK QSPRT contains an h error of 12 m/s ec during 
the transonic region and an altitude error jump at Mach 1 of 610 m 
in the opposite direction. To protect the altitude rate filter 
discussed in Section 3.5 from the jump in indicated altitude at 
Mach 1, the gains k^ and k 2 are set to one and zero respectively 
in the transonic region. 
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8.4.3 Directional Gyro Turn Error Effects 

The error in the rate gyro RK residuals arising from uncompensated 
directional gyro turn error are of the form 

t t t . 

e(t) = / c ? dt = c 5 | - / c C dt ( 8 . 2 ) 

t c *o 

where c is the directional gyro turn error and 5 is the function of 
<J> and 0 given by Eq. (3.16) for each of the rate gyros. We make an 
approximation to the absolute value of the error given in Eq. (8.2) 
by the following expression: 

|e] ~ jc (t) 5 (t) j + |c (t Q ) S (t Q ) | (8.3) 

We note that Eq. (8.1) implies 

C I < l£ 2 -t -!- 2 X (8.4) 

4 

and we define the magnitude of the RK residual error arising from 
directional gyro turn error assumed for RK QSPRT calculations to be 

% = \ [(<f> 2 (t o )+0 2 (t o )) ]C(t Q ) j + (<js 2 (t)+ 6 2 (t)) ) ? (t) | ] (8.5) 

Although Eq.{8.5) is not strictly conservative for all hypothetical 
trajectories, we feel that the probability that Eq.(8.5) is optimistic 
in the constrained dynamic environment of an aircraft is exceedingly 
small. This belief is reinforced by the extremely conservative 
QSPRT 1 s obtained including the term given by Eq.(8.5) when applied 
to the telemetry segments. We emphasize that future plans call for 
explicit DG turn error correction using the technique of Appendix F, 
obviating the need for the QSPRT term corresponding to Eq. (8.5). 

8.4.4 Instrument Self-Test 

One form of information which has been ignored up to this 
point is the fact that the change in the aircraft state between 
successive samples is limited by physical considerations. In order 
to exploit this fact, a self -test routine has been added to the FDI 
algorithm. A dual redundant instrument is declared failed if over 
a three sample interval 

1 ) the magnitude of the difference between the sensor output 
and its output at the beginning of the interval 
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and 


2) the magnitude of the difference between the sensor output 
and its neighbor instrument's output 

both exceed a given threshold value at each sample. Of course 
only the test on the sensor's own output is required for a non- 
redundant sensor. Additionally, the sensor is provisionally failed 
the first time it fails the test. However if it passes the test 
on one of the next two samples, the provisional failure status 
is removed. The threshold values currently employed for self- 
test are given in Table VIII. These threshold values have been 
chosen so that no false alarm is given by self-test for a single 
active instrument of any type throughout the nine telemetry segments. 
Because an instrument failing self-test is automatically removed 
from the active instrument complement, the thresholds should be 
chosen such that the probability of false alarm is essentially 
zero. Thus, if future flight data indicates that the performance 
of the aircraft exceeds any of these thresholds, that threshold 
should be raised. 


Table VIII Self-Test Thresholds 


Sensor Type 

Threshold 

a , a , a 

.25 g 

X 

TJ 

K 

N 

1.0 rad/sec 

q- r 

0.25 rad/sec 

<!> 

0 . 6 rad 

9, Ip 

0.15 rad i 

Mach 

O 

o 

00 

a, 8 

0.1 rad 

h 

300 m 


The self-test routine is a suitable complement to the analytic 
redundancy FDI routines in the following way. Self-test removes 
an instrument with a large bias failure from all calculations in 
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as little as one sample period, while the analytic redundancy tests 
are of necessity slower in order to overcome possible unmodeled 
biases in other sensor types. On the other hand, the analytic 
redundancy tests can identify low level biases, and in many cases 
ramps and scale factor failures, which are totally undetectable 
via self-test. 

8 . 5 Injected Failure Identification 

In this subsection we review the performance of the modified 
FDI algorithm in identifying failures injected into the telemetry 
data. Although the results by no means represent an exhaustive 
combination of failure times, failure sizes, unfailed instrument 
noises etc., we feel the results are indicative of both the power 
of the algorithm and its limitations. The intent has been to inject 
failures at times of high potential test error. We have been 
careful to assure that the injected failures result in a failed 
instrument, e.g. we do not add a positive BFM bias to an instrument 
which already has a substantial negative bias. 

For each injected failure discussed, a single figure will be 

presented containing four frames. The first frame indicates the 

time history of the direct redundancy (DR) SPRT for the failed 

instrument type. The remaining three frames show the time histories 

of quantities related to the primary form of analytic redundancy 

* 

for the failed instrument type. The second frame shows the QSPRT; 
the third frame shows the residuals for the two instruments, which 
are the inputs for their respective SPRT's; and the fourth frame 
shows the output of the two SPRT's. All variables are initialized 
to zero, and the time of failure detection by the direct redundancy 
trigger can best be seen as the time at which the DR SPRT first 
becomes nonzero. Periods during which the analytic redundancy 
test is not running, following false alarm indication or failure 
identification by the outer loop, are indicated by unchanging values 
of all of the plotted variables . The independent variable is time 
in seconds, and all of the dependent variables are dimensionless 

except the residuals, which have the dimensions of radians for RK, 

2 

m/sec for TD, m/sec for TK and meters for AK. In the third and 
fourth frames which contain two plots each, denotes a variable 

associated with instrument 1 and " 0" denotes a variable associated 
with instrument 2 . 

*Recall that these primary tests are RK for the attitude and attitude 
rate gyros, TD for the alpha vanes and lateral accelerometers, TK 
for the longitudinal accelerometers and AK for the normal 
accelerometers . 
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It is important to note that the SPRT's and QSPRT's plotted 
in the figures in this subsection have been normalized by the t’hresh- 
dld magnitude of 9.2, and thus the failure and no-failure thresholds 
for the plotted variables are -1 and +1 respectively. Although we 
will refer to the plotted variables as QSPRT's and SPRT's, the word 
"normalized" should be tacitly assumed by the reader. 

8.5.1 Roll Rate Gyros 

Figure 8-19 indicates algorithm performance following the 
injection of a positive BFM bias on roll rate gyro 1 starting at 
29.04 seconds of segment 4c. Reference to Fig. 8-12 indicates that 
at this time the aircraft is banked at 0.4 radians and is about to 
experience a roll rate pulse peaking at -0.6 rad/sec. The direct 
redundancy trigger occurs at 29.22 seconds initiating the RK tests. 
Following detection the DR SPRT grows progressively more negative, 
corroborating the trigger. Between 29.22 seconds and 30.96 seconds, 
the QSPRT is set at +1 ,' indicating that WCF > WCU as discussed in 
Section 5. At 30.96 seconds the QSPRT is set to WCF, which is 
negative but greater than -1 . Because the SPRT for instrument 1 
is less than -1 at this point, the outer loop provisionally fails 
roll rate gyro 1, removing it from all calculations unrelated to roll 
rate gyro FDI. One sample later at 31.02 seconds the QSPRT is below 
-1 and roll rate gyro 1 is identified as failed. Note that although 
the residuals for instrument 2 indicate a negative bias on that 
instrument with an average magnitude of approximately BFM/3, the 
SPRT for instrument 2 has no difficulty in determining that it is 
unfailed. 

In Fig. 8-20, a positive BFM bias is added to roll rate gyro 2 
from the beginning of segment 4A. In this segment the aircraft is 
at a bank angle of -1.1 radians. Therefore the QSPRT term due to 
turn error, Eq. (8.5), is generally larger in this segment than in 
segment 4C, and this is reflected in a longer identification time here 
than required for segment 4C. At t=.18 seconds the direct redundancy 
trigger is given, and the DR SPRT and the SPRT for instrument 2 
both start growing negative. Until approximately 3 seconds, WCF is 
greater than WCU and the QSPRT is set to +1. From 3 seconds on, 
the QSPRT is set to WCF. At 4.68 seconds the QSPRT drops below -1, 
and since the SPRT for instrument 2 is below -1, instrument 2 is 
identified as failed. Again we note that in spite of the nonzero 
residuals for instrument 1, the SPRT has no difficulty in ascertain- 
ing that instrument 1 is unfailed. 
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In Fig. 8-21 roll rate gyro 2 is failed to zero at the beginning 
of segment 3. This segment contains a series of large roll rate 
doublets beginning at 17.'. 7 seconds. However the roll rate gyro direct 
redundancy trigger is first given at 13.14 seconds due to a small 
negative roll rate indicated by instrument 1 compared to the zero 
output of instrument 1. The sign of the difference between instru- 
ments 1 and 2 is negative, and therefore the RK SPRT's are looking 
for the effects of a negative bias on instrument 1 and a positive bias 
on instrument 2. Because of the oscillatory nature of the actual 
roll rate, the sign of the error in instrument 2 soon changes from 
plus to minus, and this is reflected by the DR SPRT becoming positive. 
Thus at 14.64 seconds the outer loop declares a false alarm and all 
of the tests are terminated. We note that during the 1.5 seconds that 
the DR SPRT was negative, the SPRT for instrument 2 quickly crossed 
-1. However no identification was made because the QSPRT remained 
at +1, reflecting the small value of the error in instrument 1 
compared to the possible test errors. At 17.7 seconds the direct 
redundancy trigger is again given, this time with the sign of the 
differences between instruments 1 and 2 being positive. Thus the RK 
SPRT's are initiated looking for the effects of a positive bias on 
instrument 1 and a negative bias on instrument 2. The DR SPRT 
immediately becomes negative as does the SPRT for instrument 2. In 
two samples, at 17.82 seconds, the QSPRT becomes negative and in- 
strument 2 is provisionally failed. In two more samples the QSPRT 
crosses -1 and instrument 2 is identified as failed. The speed with 
which the QSPRT crosses -1 is directly related to the large differ- 
ence between the two instrument outputs at this time, reflecting the 
large value of the true roll rate in this region. 

8.5.2 Pitch Rate Gyros 

Figures 8-22 through 8-24 present results for the pitch rate 
gyros analogous to the roll rate gyro results presented in Figs. 8-19 
through 8-21. In Fig. 8-22 a negative BFM bias is added to the output 
of pitch rate gyro 1 at 29.04 seconds of segment 4C, and the direct 
redundancy trigger for the pitch rate gyros occurs at 29.16 seconds. 

At 30.66 seconds the QSPRT drops below -1, and since the RK SPRT 
for instrument 1 is also below -1 at this time instrument 1 is 
identified as failed. Note that the residuals for instrument 2 
indicate a bias level of approximately BFM/ 4 on that sensor. 
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In Pig. 8-23 a positive BFM bias is added to the output of pitch 
rate gyro 2 from the beginning of segment 4A. Because of the large 
magnitude roll angle present during this segment, there is a large 
amount of turn error assumed in the pitch rate gyro RK QSPRT. This 
is reflected by the fact that the QSPRT remains at +1 until 33.96 
seconds, at which point instrument 2 is identified as failed. Note 
that due to uncompensated DG turn error, the SPRT for instrument 1 
is below -1 and less than the SPRT for instrument 2 for the first 
16 seconds. However, no possibility for false identification exists 
because the RK QSPRT is +1 in that time interval. 

In Fig. 8-24 the output of pitch rate gyro 2 is set to zero 
from the beginning of segment 3 . With the onset of the negative 
pitch rate pulse at 5.64 seconds the pitch rate gyro direct redundancy 
trigger is given. Both the DR SPRT and the RK QSPRT and the RK SPRT 
for instrument 2 become negative immediately. After three samples 
the RK QSPRT becomes negative and instrument 2 is provisionally failed. 
At 6.3 seconds the QSPRT crosses below -1 and instrument 2 is identi- 
fied as failed. The fact that the slope of the DR SPRT has just 
changed from negative to positive at failure identification indicates 
that the actual pitch rate measured by the unfailed sensor has just 
passed through zero. 

8.5.2 Yaw Rate Gyros . 

Figures 8-25 through 8-27 present results for the yaw rate 
gyro analagous to the roll rate and pitch rate gyro results. In . 

Fig. 8-25 a negative BFM bias is added to the output of yaw rate 
gyro 2 starting at 29.04 seconds of segment 4C . The direct redundancy 
trigger is given at 29.22 seconds, and the DR SPRT and RK SPRT for 
instrument 2 immediately grow negative. At 32.4 seconds WCF drops 
below WCU, the QSPRT is evaluated as WCF which is below -1, and 
instrument 2 is identified as failed. The initial ramp in the 
residuals for instrument 1 is due to the scale factor error in the 
signal conditioner for that sensor, the effect of which diminishes 
following the negative . peak in yaw rate at 29.4 seconds. 

In Fig. 8-26 a positive BFM bias is added to the output of yaw 
rate gyro 1 from the beginning of segment 4A.. The direct redundancy 
trigger is given at .18 seconds. Due to the large turn error assumed 
by the RK QSPRT, the QSPRT is set to +1 until 20.32 seconds. In 
the mean time the DR SPRT and the RK SPRT for instrument 1 have both 
become large magnitude negative numbers. At 22.32 seconds the QSPRT 
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is calculated as WCF which is less than -1, and instrument 1 is identi- 
fied as failed. As in Fig. 8-23 for the pitch rate gyros, there is 
some drift in the residuals due to DG turn error. Because the 
worst case turn error assumed by the yaw rate gyro RK QSPRT is pro- 
portional to | cos $ | while the effect on the pitch rate gyros is 
proportional to | sin <j> | , the roll angle of -1.1 radians present in 
this segment produces a larger effect of turn error on the pitch rate 
gyros than on the yaw rate gyros. This is reflected in the identifi- 
cation time of approximately 22 seconds in Fig. 8-26 compared to 34 
seconds in Fig 8-23. 

In Fig 8-27 the output of yaw rate gyro 1 is set to zero from 
the beginning of segment 3. The direct redundancy trigger is given 
eight times in the segment, but false alarm indicators are given in 
every case and the failure is not identified because of the low mag- 
nitudes of the actual yaw rate peaks and the fact that the yaw rate 
peaks appear at times of appreciable roll angle magnitude with 
corresponding large DG turn errors assumed by the RK QSPRT. The 
SPRT's for the two instruments, especially between 20 and 24 seconds, 
suggest that a clear decision is possible and the RK QSPRT is overly 
conservative in this particular run. Significantly better performance 
should be possible using DG outputs compensated for turn error as 
discussed in Appendix F. In that case little or no turn error need 
be assumed by the RK QSPRT' s, and identification of yaw rate gyro 
failures to zero should be possible. 

8.5.4 Vertical Gyros 

Figures 8-28 and 8-29 illustrate the identification of simultaneous 
BFM magnitude biases on roll attitude gyro 1 and pitch attitude gyro 1, 
respectively, injected at 37.02 seconds into segment 2. The sign 
of the roll attitude gyro bias is negative and the sign of the pitch 
attitude gyro bias is negative. To investigate the worst-case 
conditions, roll rate gyro 1 and pitch rate gyro 1, which have small 
biases, are assumed disabled and only their larger biased companion 
instruments are used in the RK calculations. The sign of the in- 
jected bias on roll attitude gyro 2 is chosen to be opposite the 
sign of the bias in roll rate gyro 1, and the sign of the injected 
bias on pitch attitude gyro 1 is chosen to be opposite the sign of 
the bias in pitch rate gyro 2. This is the worst possible situation 
since the rate biases tend to cancel the effect of the bias on the 
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failed attitude gyro and tend to make the unfailed attitude gyro 
appear to be failed. Thus in the figures the sign of the residual 
for the unfailed attitude gyro is opposite that of the failed attitude 
gyro and the magnitude of the residual for the failed attitude gyro 
is smaller than the BFM size. It is important bo remember that 
Figs 8-28 and 8-29 give only the values of the plotted variables 
after processing the stored window of residuals. Thus the sharp 
discontinuities should not be interpreted as actual time histories. 

The failure of roll attitude gyro 1 is detected by the direct redun- 
dancy trigger and identified at 37.14 seconds, while the failure 
of pitch attitude gyro 1 is detected and identified at 37.08 seconds. 
These results suggest that the more elaborate technique for VG FDI 
discussed in Appendix D is unnecessary. 

8.5.5 Mach Meters 

Recall that the primary test for the Mach meters is TK, and 
the bias failure signature is a jump in the k=0 residuals. To 
accomodate the jump behavior of an unfailed Mach meter in the transonic 
region and measurement noise, the TK QSPRT for the Mach meters assumes 
a worst case initialization error of 21 m/sec if detection occurs in 
the transonic region. This precludes identification of Mach BFM 
biases occurring in the transonic region. The need for this QSPRT 
provision is shown in Fig 8-30, in which a negative BFM bias is added 
to Mach meter 1 at 130 seconds of segment 4B. This is exactly the 
time at which the unfailed Mach meter jumps from .95 to 1.02. Note 
the high initial residual in unfailed instrument 2 and the low 
residual in instrument 1 due to cancellation of the actual jump and 
the injected bias. In this case the SPRT's indicate that instrument 
2 would have been falsely identified as failed if the QSPRT had 
crossed -1. However the QSPRT remains positive and no identification 
is made. The DR SPRT remains negative indicating the persistence 
of the failure. After the TD ETL of 20 seconds, during which the 
secondary TD test is predictably unable to make an identification, 
the tests are started again. In this case there is no jump in the 
TK residuals, and although the QSPRT is initially below -1 no identi- 
fication is possible following this or the subsequent restart. Note 
that following restart outside the transonic region the QSPRT quickly 
becomes positive to avoid false identification due to the ramps in 
the TK residuals arising from errors in the measured acceleration. 

We reiterate that although detected unidentifiable Mach BFM biases 
are possible in the transonic region, false identification is not. 
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In Fig. 8-31 a positive BFM bias is added to the output of Mach 
meter 1 at 160 seconds of segment 4B, and the failure is detected 
and identified at 160.2 seconds. In Fig. 8-32 a positive BFM bias 
is added to Mach meter 2 at 8.04 seconds into segment 4A, and the 
failure is detected and identified at 8.22 seconds. 

8.5.6 Alp ha Vanes 

In Fig. 8-33 a positive BFM bias is added to alpha vane 1 at 
130 seconds of segment 4B. The failure is detected at 130.8 seconds, 
and the DR and TD tests are initiated. The DR SPRT, TD QSPRT and 
TD SPRT for instrument 1 all grow negatively, and instrument 1 is 
identified as failed at 131.34 seconds. In Fig. 8-34 a positive 
BFM bias is added to alpha vane 1 at 36 seconds of segment 4C, a 
region of high dynamic pressure. Detection occurs at 36.84 seconds 
and identification at 37.32 seconds. 

8.5.7 Longitudinal Accelerometers 

Recall that the primary test for the longitudinal accelerometers 
is TK and that allowance for possible wind shear by the QSPRT makes 
detection times rather long. Additionally the QSPRT terms allowing 
for Mach meter behavior preclude BFM bias identification in the 
transonic region. However, because the effect of a longitudinal 
accelerometer bias persists as a ramp in the TK residuals, identification 
is only delayed and not prohibited as in the case of a Mach meter bias. 

This is illustrated in Fig 8-35 in which a positive BFM bias is 

added to longitudinal accelerometer 2 at 80 seconds into segment 4B. 

The failure is detected by the redundancy trigger at 80.82 seconds, 
and the DR SPRT and analytic redundancy tests are initiated. By our 
definition the transonic region is between 85 and 135 seconds of this 
segment. Thus at 85 seconds additional noise terms begin to be 
added to the TK QSPRT, and this prevents the QSPRT from becoming 

negative before the TK ETL of 32 seconds has elapsed. During this time 

the DR SPRT indicates there is no doubt that a failure is present. 

Thus at 113 seconds the DR SPRT and TK tests are restarted. Again 
the DR SPRT grows quite negative indicating the bias is still present, 
but the terms added to the TK QSPRT to accommodate Mach meter behavior 
in the transonic region do not allow WCF to drop below WCU before 
the TK ETL has elapsed. Thus a second restart is begun at 145 seconds, 
which is beyond the transonic region. Again the SPRT and the TK SPRT 
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for instrument 2 immediately grow negative. At 158 seconds the 
QSPRT becomes negative and instrument 2 is provisionally failed, and 
at 160.2 seconds the QSPRT crosses -1 and instrument 2 is identified 
as failed. 

Although in most cases a failure to zero of a longitudinal ac- 
celerometer cannot be identified, it is possible in segment 4A, where 
the average longitudinal acceleration is .22 g. In Fig. 8-36 the 
output of longitudinal accelerometer 1 is set to zero from the begin- 
ning of segment 4A. Detection by the direct redundancy trigger 
occurs at .78 seconds. From that point on the DR SPRT and the TK 
SPRT for instrument 1 grow progressively more negative. At 20.7 
seconds the TK QSPRT becomes negative and instrument 1 is provisionally 
failed, and when the QSPRT crosses -1 at 21.4 seconds instrument 1 
is identified as failed. 

8.5.8 Lateral Accelerometers 

Figure 8-37 depicts the identification of a negative BFM bias 
on lateral accelerometer 2 injected at 12 seconds of segment 4A. 

In this segment there is a steady -state slideslip angle of -.02 
radians, with a large aileron doublet and subsequent sideslip 
oscillation beginning at 14 seconds. The lateral accelerometer 
direct redundancy trigger is given at 12.48 seconds. As shown in 
the figure the DR SPRT, TD QSPRT and TD SPRT for instrument 2 all 
start growing negative. In these lateral accelerometer runs a factor 
of 0.3 was used to multiply the stored C^g function, and the near 
zero residuals for unbiased instrument 1 before 14 seconds indicate 
that this correction is fairly accurate. The oscillatory behavior 
of the residuals starting at 14 seconds arises from the combined 
effects of neglecting the C Y(5a term and C y g error. * The variance 
used in the lateral accelerometer TD SPRT's, currently 9.3m /sec 4 , 
is sufficiently large that these oscillations cannot lead to false 
identification. Returning to the figure, at 14.34 seconds the TD 
SPRT for instrument 2 reaches -1, at which time it is provisionally 
failed. When the TD QSPRT reaches -1 at 15.6 seconds, instrument 2 
is identified as failed. 

In Fig. 8-38 a positive BFM bias is added to the output of 
lateral accelerometer 2 at 36 seconds of segment 4 C. Recall that 
this is a region of high dynamic pressure containing roll rate. 
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yaw rate and sideslip angle oscillations in response to a rudder 
doublet. The direct redundancy trigger is given at 36.48 seconds, 
and as before the DR SPRT, TD QSPRT and TD SPRT for instrument 2 
start growing negative. At 39.42 seconds the SPRT for instrument 2 
reaches -1, and that instrument is provisionally failed. At 43.62 
seconds, the TD QSPRT reaches -1 and instrument 2 is identified 
as failed. 

8.5.9 Normal A ccelerometers 

The primary test for the normal accelerometers is AK, and neither 
TK nor TD is capable of identifying a normal accelerometer BFM bias 
because of possible test errors arising from BFM/ 2 biases in unfailed 
instruments. Because the vertical acceleration arising from a normal 
accelerometer bias is proportional to cos <£ , the effect of a normal 
accelerometer failure is reduced by more than 50% in segment 4A, in 
which there is a sustained roll angle of -1.1 rad. Thus a BFM bias 
cannot be identified in segment 4A. This is a fundamental limitation 
of the AK test, and proper pilot response to the indication of an 
unidentifiable normal accelerometer failure would be leveling of the 
wings. We note that in all of the segments a 2 BFM or larger normal 
accelerometer bias jump is immediately identified by self-test. 

The addition of error terms in the AK QSPRT in the transonic 
region does increase the identification time. The ability to identify 
the failure within the presently defined ETL depends upon where in 
the transonic region the failure occurs. This is illustrated in 
Fig. 8-39 and 8-40 in which negative BFM biases are added to normal 
accelerometer 2 at 90 seconds and 125 seconds respectively of segment 
4B. In Fig. 8-39 the normal accelerometer direct redundancy trigger 
is given at 90.84 seconds, and from then on the DR SPRT and the AK 
SPRT for instrument 2 grow increasingly negative. Note that the 
fictitious behavior of the altimeter occurs long enough after failure 
detection that the SPRT ' s for the two instruments are not greatly 
affected. Reflecting this fact the QSPRT crosses the negative thresh- 
old at 137.1 seconds and instrument 2 is identified as failed. This 
identification occurs a fraction of a second before the AK ETL of 
47 seconds has elapsed. In Fig. 8-40 the direct redundancy trigger 
occurs at 125.84 seconds, indicating the sign of instrument 1 minus 
instrument 2 is positive. The positive jump in the altimeter at 
130 seconds results in positive residuals for both instruments. 
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and because of the sign of the instrument difference from the trigger 
instrument 1 appears to be failed. Thus the SPRT for instrument 1 
begins growing very negative while the SPRT for instrument 2 grows 
quite positive. Not until a few seconds before ETL does the SPRT 
for instrument 1 start growing in the positive direction. After the 
ETL has elapsed at 172.8 the QSPRT is still at +1, and the tests are 
restarted. Insufficient time remains until the end of the segment 
for any decision to be made. The required identification time outside 
the transonic region is approximately twenty seconds. This is il- 
lustrated in Fig. 8-41, in which a negative BFM bias is added to 
normal accelerometer 2 at 140 seconds of segment 4B. The failure 
is detected at 140.9 seconds and identified at 160.9 seconds. The 
small h error apparent in the residuals for instrument 1 verify the 
effectiveness of the algorithm modification to protect the altitude 
filters from the altimeter jump at Mach 1. 

In Fig. 8-42 a positive BFM bias is added to normal accelerometer 
1 at 10.02 seconds of segment 4C , and the direct redundancy trigger 
is given at 10.98 seconds. Recall that this segment contains some 
slow ramping in roll angle, which produces time-varying observability 
of the normal accelerometer bias in the AK residuals. However, 
because the maximum roll angle magnitude is only 0.4 radians, the 
effect on failure identification time is negligible with identifica- 
tion occurring at 30.54 seconds. 

It is important to note that the relatively long normal acceler- 
ometer BFM bias failure identification times observed here are directly 
the result of the large altitude quantization size in the telemetry 
data, and therefore the identification times seen in Section 7 more 
closely reflect the performance of an onboard system. 

8 . 6 Summary 

In this section, the analytic redundancy FDI algorithm has been 
modified to perform well on telemetry data from the F-8 DFBW aircraft. 
In essence the modification consists of two stages: 

1) A choice of new BFM levels and ETL ' s using telemetry bias 
and noise characteristics and the techniques discussed in 
Section 4. 

2) The addition of terms to appropriate QSPRT' s to accommodate 
DG turn error and air data sensor behavior in the transonic 
region. 
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Additionally direct compensation is added for the alpha vane bias 

* 

in supersonic flight, and a technique for DG compensation for turn 
error has been developed in Appendix F which will be implemented in 
the future. We emphasize that the modification process is extremely 
simple and equally applicable to any set of instruments, and that 
the FDI framework of trigger, SPRT's and outer loop remains unchanged. 

The FDI algorithm, although designed to identify instruments 
with bias jumps, has demonstrated its ability to identify failures 
to zero of the roll rate and pitch rate gyros in -moderate level 
oscillatory maneuvers. In addition it is felt that this capability 
will be expanded to the yaw rate gyros with the addition of the DG 
turn error correction scheme. This demonstrated zero scale factor 
failure identification capability indicates that the explicit scale- 
factor FDI algorithm suggested in Appendix C is not necessary for 
this level of failure. 

The addition of sensor self-test has allowed the accelerometer 
hard failure identification times obtained in Section 7 to be lowered. 
For a l/2g bias failure the times in Table IV now are changed to zero 
detection time with provisional failure in one sample and failure 
identification in two additional samples. Because the rate gyro 
simulated hard failure level of 0.1 rad/sec used for Table IV is 
below our chosen rate gyro self-test thresholds, this level of bias 
must be identified by the RK tests in the present algorithm, and the 
detection and identification times for these rate gyro biases remain 
essentially unchanged. 

The algorithm has proven its ability to detect and identify BFM 
biases throughout a range of flight conditions. Only three areas of 
significant performance degradation from previous simulation ex- 
perience have been observed: 

1) Inability to identify Mach BFM bias in the transonic region 

2) Extended identification times for pitch rate gyro and yaw 
rate gyro BFM failures during long turns 

3) Extended normal accelerometer BFM bias identification times. 

Although problem 1) must remain in some region around Mach 1 due to 
the unfailed instrument characteristics, its effect may be minimized 
by decreasing the indicated Mach region within which the Mach meter 
TK QSPRT assum es a Mach jump may occur. Detailed examination of the 
* 

In addition examination of the residuals in Fig. 8-35 and 8-39 suggest 
supersonic biases in the Mach meters and altimeters of approximately 
0.04 Mach and 275 m respectively. The Mach bias will be compensated 
in future versions of the algorithm. 
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Mach meter output indicates that a sufficiently large region may 
be defined as the time that the filtered Mach estimate is between 

0. 94 and 1.03. On Segment 4B this region is only ten seconds long. 
It is anticipated that problem 2) will disappear with the addition 
of DG turn compensation, and problem 3) will not exist for the 
onboard system with available altimeter output quantized at 3.4 m. 

Although no DG PDI was performed, the results of Appendix F 
indicate that the turn error compensated DG signals are quite well 
behaved, and that DG FDI is possible. However if it is determined 
that the dominant failure mode results in ramping RK residuals, 
the DG RK SPRT's should be modified to look for that effect. 

Because the output of only one altimeter was provided, no al- 
timeter FDI was performed. However, the only apparent limitation 
on altimeter FDI is the same as the restriction on Mach meter FDI, 

1. e., BFM bias jumps cannot be identified in a small region around 
Mach 1 due to nominal behavior of the instruments. 
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Figure 8-2 Segment 1 (cont.) 



Figure 8-3 Segment 2 
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Figure 8-7 Segment 4A 
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Figure 8-9 Segment 4B 
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Figure 8-18 Segment 6 (cont.) 
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SECTION 9 


CONCLUSIONS AND RECOMMENDATIONS 


In this report we have presented the development of the analytic 
redundancy sensor FDI algorithm from its theoretical foundations 
through computer simulations to its successful application to telemetry 
data from the F-8 DFBW aircraft. The FDI framework of trigger, 

SPRT ' s , QSPRT ' s and outer loop has demonstrated its versatility 
through the ease by which it was modified to accommodate the instrument 
telemetry characteristics, which were significantly different in many 
cases from the idealized sensors of Table I. The modified FDI al- 
gorithm has given consistently reliable identification when applied 
to biases injected in the telemetry data and it has identified failure 
to zero in those situations where we feel the failure could critically 
impact the control system. Additionally no false detections or false 
identifications have been encountered in either the computer simulations 
described in Section 7 or the telemetry data applications discussed 
in Section 8. We also note that a technique has been developed to 
allow FDI for the DG's, whose raw outputs disagree drastically during 
maneuvers. This technique is essentially the same as that used for 
the VG ' s except that the DG outputs will be compensated for turn error 
before use and a low level drift between the compensated outputs of 
the two DG's will be allowed. 

For completeness we mention here that as an alternative to time 

3 

triggers a technique developed by Chxen may be used to identify the 
failure of a single nonredundant sensor using the analytic redundancy 
tests we have developed. In Chien's procedure the SPRT output is 
reset to zero whenever it is computed to be positive, and the calculation 
of the negative (i.e. failure) threshold is somewhat different than 
for the standard SPRT, resulting in a slightly lower threshold for 
the same false alarm probability. Using either Chien's technique or 
a time trigger approach, we see that analytic redundancy allows nominal 
control system operation until such a time as no unfailed instrument 
of some type remains. 
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Recall that for nearly all of the instrument types for which 
secondary analytic redundancy tests exist, the secondary tests are 
unable to identify a BFM bias failure, and for those few secondary 
tests which can identify a BFM bias failure the identification time 
is significantly longer than for the primary test. Additionally, in 
none of the simulations performed to date has a failure remained 
unidentified by the primary test long enough to allow identification 
by the secondary test. Although this experience does not imply that 
there are no situations in which only the secondary test can identify 
the failure, it does suggest the low probability of such situations. 

And should such a situation ever arise, correct pilot response will 
enhance observability to allow identification by the primary test. 

For these reasons and in order to minimize computer timing and storage 
requirements, we suggest that for the flight test algorithm only the 
primary tests be retained for the Mach meters, alpha vanes, longitudinal 
accelerometers, rate gyros and attitude gyros. Thus secondary tests 
will be retained only for the lateral and normal accelerometers. We 
suggest retaining the secondary AK test for the lateral accelerometers 
to allow FDI on these instruments after the loss of the nonredundant 
beta vane, and we suggest retaining the secondary TD test for the 
normal accelerometers to allow some analytic redundancy coverage for 
these instruments during periods of sustained roll angle or transonic 
flight. We also propose retaining the self-test algorithm to minimize 
the impact of hard failures on the flight control system. 

We feel that the BFM levels chosen in Section 8 should be retained 
for flight test except for the longitudinal accelerometers and yaw 
rate gyros which should be lowered to 1.5 m/sec and .01 rad/sec 
respectively. These changes are justified because the BFM's chosen 
in Section 8 for these instruments reflected faulty signal conditioner 
behavior and not the actual instrument characteristics. The lowered 
yaw rate gyro BFM should also facilitate DG FDI 

In an effort to trim inefficient calculations, the k ^ 0 attitude 
estimators should be eliminated entirely, with the differences between 
the measured and propagated attitude changes over each interval of 
the window saved for the attitude gyro RK SPRT ' s . Similarly the k ^ 0 
air-relative velocity estimators should be eliminated, with differences 
between the measured and propagated longitudinal velocity changes 
over each interval of the window saved for the Mach meter TK SPRT 1 s . 

This new procedure also reduces the construction of the k = 0 residuals 
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to a simple sum. The wind turbulence estimator will still follow the 
technique of Appendix A, but the input will be the difference between 
measured and propagated lateral velocity change over each successive 
sample interval. 

Preliminary estimates have been made on the computer timing and 
core requirements for the proposed FDI algorithm. The timing estimate 
is obtained by adding the times required for all overhead arithmetic 
calculations such as self-test, DR triggers, failure injection and 
filter management to the time required for analytic redundancy tests 
for the sensor types with the most processing - the lateral and 
normal accelerometers. The execution times for various arithmetic 
operations on the IBM AP-101 computer which were used in this estimate 
are shown in Table IX. 


Table IX AP-101 

Execution Times 

OPERATION 

TIME (usee) 

+ 

2 

- 

2 

X 

5.8 

v 

9.6 


The combined time for arithmetic operations is then multiplied by 1.3 
to allow for the non-arithmetic calculations, and a figure of 3 msec 
is obtained. Assuming a cycle time of 60 msec, this represents a 5% 
computer timing requirement. 

In order to estimate the computer core requirements for the 
proposed onboard FDI algorithm, a FORTRAN IV System 360 version of the 
proposed algorithm has been written and compiled using the H option 
with the optimization parameter OPT set to 2. This FORTRAN program 
occupies 6800 32-bit words. It is very difficult to accurately 
translate this figure into equivalent AP-101 code for two reasons: 
First, direct translation efficiency is extremely dependent upon the 
actual FORTRAN code and second, direct coding in machine language 
to accomplish a particular job step is almost always more efficient 
than translating code generated by a high order language such as 
FORTRAN. Despite these difficulties, a worst case conversion factor 
from FORTRAN /3 6 0 to AP-101 core requirements of .67 is often used. 
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and- this figure arises from the large number of half-word instructions 
in the AP-101 instruction set compared with FORTRAN. Using this factor 
the maximum core required by the proposed analytic redundancy sensor 
FDI algorithm is 4600 words, which represents approximately 14% of 
the total computer space. However we feel that through direct machine 
language coding this core requirement figure can be lowered to the 
neighborhood of 3000 words. 



APPENDIX A* 


TURBULENCE ESTIMATOR 


As indicated in Section 3.2, it is necessary for us to be aware 
of the presence of turbulence in order to slow down the translational 
kinematics SPRT ' s , thus eliminating false identification due to wind 
shear. Our philosophy, outlined in Section 4.4.2, is to assume one of 
two levels of turbulence, either low or high, and to assume corresponding 
low or high worst-case shears for the SPRT calculations. In this 
appendix we outline the technique for detecting the presence of high 
turbulence . 

We utilize the residuals y from the translational filter, each 
channel of which has the following form in continuous time: 



Figure A-l Continuous Velocity Estimator 


In Fiqure A-l, a is the measured acceleration from the compensated 
m 

accelerometer outputs, V is the measured velocity from the air-data 

m 

sensors, n is the velocity measurement noise (assumed white), V is 
the velocity of the aircraft with respect to inertial space and W is 
the inertial velocity of the wind. 

Now, our objective is to determine whether the variance of the 
wind velocity W is "high". Assuming V is of low frequency, we 
see that the residual y consists essentially of the high frequency 
components of W and n and the low frequency noise in a^. Because 

The work summarized in Appendices A and B was performed by E. Y. Chow. 
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the high frequency component of W is the turbulence we are looking 
for, we high-pass filter the residual y to eliminate the accelerometer 
noise, leaving only the high frequency components of n and W. To 
obtain a measure of the size of these components, and thus a measure 
of the turbulence, we square the high-passed residual and then low-pass 
the squared signal . Thus we have 



Figure A-2 Residual Processing 

In Figure A-2, HPF and LPF denote first order high- and low-pass 

filters respectively. The time constants for these two filters are 

parameters chosen to give good performance in determining the presence 

of high turbulence. The time constant of LPF indicates the speed of 

response to changes in the wind turbulence, and we have chosen it to 

be 5 seconds. Because most of the energy of W is at low frequencies, 

we would like a large time constant for HPF. On the other hand, too 

"2 

large a choice will result m corruption of the variance estimate a 

with the low frequency error of a . With a wind turbulence variance of 

2 2 m 2 2 
30 m /sec (the 99% Dryden level) and a variance in n of 3.3 m /sec , 

the performance of the variance estimator in Figure A-2 is essentially 

unchanged for HPF time constants from 5 sec to 50 sec. However, 'for 

time constants lower then 0.5 sec, the estimator performance becomes 

degraded in the presence of a large mean wind velocity, which is 

clearly undesirable. Thus we have also chosen the HPF time constant 

to be 5 sec. 

With the assumption that the wind is isotropic, the effective 
measurement noise in the y channel of the decoupled translational 
estimator is the minimum of the three channels over all angles of 
attack, and therefore we have chosen to monitor the residual from 
this channel only for the wind variance estimator. 

Because we have chosen from practical considerations to make 

only a high/low turbulence decision, we must choose thresholds on the 

~2 

wind variance estimator a for this purpose. In simulations without 
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2 2 

turbulence, the wind variance estimate remains near 3.7 m /sec . With 

the onset of the 99% turbulence level, the wind variance estimate 

2 2 2 2 

quickly grows to at least 7.4 m /sec with peaks of 17 m /sec . Thus 

2 2 

we have chosen the high turbulence threshold to be 6.5m /sec . 

Following the indication of high turbulence, we demand that the 

2 2 

variance drop below 5.6 m /sec before making a low turbulence decision. 
This hysteresis has given satisfactory performance in all simulations 
to date . 
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APPENDIX B 


AERODYNAMIC COEFFICIENT APPROXIMATION 


Assuming that the aircraft is in the "clean" configuration, 
seven coefficients are required to perforin FDI using the translational 
dynamics tests. These parameters, listed as functions of flight 
condition, are*: 


C L (a ,SenJt) , 

Cy ^ (ot ) r 

T MIL (h ' V) 

Cq ( 0t fi/it ) / 

c y 6r U() ' 

T AB (h -v) 


For digital simulation purposes at CSDL and at NASA LRC, 
multidimensional table interpolation is used to determine these 
coefficients as functions of time. However, since the total number 
of table entries for these seven coefficients is approximately 1300, 
the storage overhead for this approach was felt to be too large for 
onboard implementation. This motivated an effort to obtain poly- 
nomial approximations to these coefficients, and resulted in a 
reduction in data storage locations by a factor of 8 with only a 
modest overhead in program storage and execution time. Some details 
of the approximations and the resulting vehicle acceleration errors 
follow. 

As a function of Mach, C T is rather ragged, but it is much 

Jj 

smoother as a function of a and <5e . we note that 

1. C L is almost linear in <5e 

2. C T as a function of a for fixed 6e and Mach is shaped 

JLj 

roughly as follows : 


*The coefficients C . , C and C are of negligible effect and 

y6a' yp yr 

have been ignored in this study. T MIL and T^ B are used to compute F g . 
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With these ideas in mind, the approximating polynomial for C is chosen 
to be first order in 5e. For each Mach breakpoint we have the following: 
for a <_ 10°, defined as region I, the polynomial is first order in a 
while for a > 12°, defined as region II, the polynomial is second order 
in a. Thus at each Mach breakpoint we have: 

Region I 

C L = A^ + A 2 Se + A 3 <5e a + A^a 


Region II 


= B, 


V e 


+ B^Se a + 


B. a + B c 


Bgd^fie 


For the region 10° < a < 12°, C is obtained by linear interpolation 
between regions I and II. As the polynomial coefficient A's and 
B's are stored at 12 Mach breakpoints, C is obtained at a particular 

Li 

Mach number by linear interpolation between the values of C obtained 

Li 

at the bracketing breakpoints. The choice of the A's and B's for C 

Li 

were obtained with the objective of keeping the fits good around the 
trim flight condition for two reasons. First, the majority of flight 
time will be spent in that region. Second, the actual error which 
degrades the translational dynamics SPRT's is the acceleration error, 
which is proportional to the table error times the square of Mach. 
Thus, even "better" polynomial fits in the high Mach region will not 
appreciably improve the error in the translational dynamics tests in 
that region . 


The coefficients C„ and C „ are functions of Mach and a. and 
D yB 

as with C T are ragged as functions of Mach. Thus, noting that the 

Li 
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accuracy of transonic data is questionable, we have defined three 
Mach regions and the polynomial approximation within the regions as 
follows : 

Region I: .18 <_^4( <_ .9 

C D IC ye ] = D i + D 2 a + D 3 ^r + D 4 a ^ 

Region II : 1.2 <_ ,A{ <^1.9 

CpICyg] = E 1 + E 2 a + e 3 U*+ E 4 aUT 

Region III: Wing up, without ground effect 

C D [C yB ] = F 1 + F 2 a + F 3 0(2 

For values of Mach between .9 and 1.2, linear interpolation is employed. 

The other coefficients are fitted across the entire tabulated 
region as the resulting acceleration errors are much smaller than those 
due to C T and C_ : 

W T AB ] = G 1 + G 2 h + G 3 V + G 4 hv 

C D5e = H i + H 2 a + H 3 6e + H 4 a5e + H 5 q2 + H g a 2 6e 
+ H^a 6e + HgaSe + Hg5e 

2 3 

C = L. + + 'Li-.'Ai + h 

y6r 12 3 4 

The QSPRT's for the translational dynamics tests for the 
accelerometers and air-data sensors require knowledge of the worst- 
case acceleration biases in the test due to errors in the coefficients. 
For this purpose, extensive evaluations were performed of the 
acceleration errors in body axes due to the polynomial approximations 
to the seven parameters discussed above. As a result of these tests 
two regions were defined: a region of "good" fit and a region of 

"bad" fit. The region of good fit is within the bounds: 

-10° < 5e < 5° 

- 4° < a < (20 - 13.3^0° 
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while the region of bad fit is everywhere outside the good region. 
The worst^case accelerations along body axes, due to the polynomial 
approximations, are given as functions of Mach in Table B.l for the 
good and bad fit regions: 


Table B.l Worst-Case Acceleration Error due 
to Polynomial Approximation 


Body Axis 

Good Region (m/s ec^) 

Bad Region (m/sec^) 

X 

1.96.y^ 2 + . 0063/^T 2 

.29e 2 ^ + . 00064e 10 '^ 

y 

• 65^y 2 

.65^ 2 

Z 

. 98^/ 2 + .2 9^ 

.Oiee 8 ^ + .04/^ 


2 

At trim at Mach = 0.6, the acceleration errors are .73 m/sec in x, 

2 2 
.24 m/s ec in y and .53 m/s ec in z. 
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APPENDIX C 


SCALE FACTOR FAILURES 


We have developed a methodology for adapting the analytic 
redundancy SPRT's for the various instrument types to the detection 
of scale factor failures. In this section we derive the form of the 
SPRT for the roll rate gyro. The analysis for the other instruments 
is similar. Recall that the rotational kinematics residual for p is 
of the form 


Y(t) = L p m (T)dT “ 4 ’m (t) + *m (0) + L V t) sin 0 ™ (t)dt 


Suppose now that we have a scale factor failure, i.e., that 

P m (t) = vp(t) + noise 

where v is the scale factor. Let us define 

t 

C(t) = / p (t ) dr (C.l) 

o 

and 


p(t) = ~ 4> m ( 0 ) - / <|i m (t) sin 6 m (t) dt = E,(t) + noise 

o 


(C . 2) 


Then 


y(t) = (v-1) p(t) + noise 


and we can define an SPRT of the form 


u = l 

n k=l 


(v-1) p(t k ) r (v-1) p(t k ) 


" Y (t k } 
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Note that in this case the residual p(t) is dependent on 
the data and must be computed on-line, i.e., the effect of a scale 
factor failure is modulated by the flight trajectory. For example, 
if p(t) = 0, then except for the noise p(t) = 0. Also note that v 
is the "failure extent parameter" which must be chosen, replacing the 
bias size B. Finally, it is clear that the time until detection depends 
upon the time history of the variable p. Thus in order to calculate ETL 
we must postulate a nominal trajectory for p. Given the time history 
of p, we can compute the expectation of the SPRT output when there is 
no failure (H 2 ) as 


n (v-1) 2 5 2 (t,) ( v 2 -l) n 

E[ujH 2 ] = 1 — L + 


j=l 


2cr 


(C . 3 ) 


and when there is a failure (H^) as 


In Eq. (C . 3 ) and (C.4) the second term is due to the fact that p(t), 

2 

the measurement of £(t), contains noise of variance a . Note that for 
v<l, this test bias tends to drive the SPRT toward the negative (failure) 
threshold. Hence, one may want to remove this bias from the SPRT 
before making failure decisions. 

We now illustrate how one might evaluate the parameters 
for a failure identification system based on this SPRT. To do this 
we must postulate a trajectory for p. We will exclude the case of 
constant p from consideration since the failure will effectively 
appear as a bias and will be identified by the SPRT ' s enumerated in 
Sections 3 and 4. Because oscillatory trajectories for p are those 
which most require a scale factor test, we consider trajectories of 
the form 


E [u 


n (v-1) 2 C 2 (t.) (v 2 -l)n 

H,] = - l 5 L + (C.4) 

j-1 2a 2 


p(t) = A sin ot (C.5) 

Making the usual integral approximation to Eq. (C.4) and substituting 
Eq. (C.l) gives the following equation for the time T c at which the 
failure threshold is crossed: 
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(V-1) 
2 a 2 T 


T 

c T -] 

/ / p(s) ds 

A -J 


p (s) ds dx = 9 . 2 + 


(v -1) T 


2T 


Evaluating the integral using (C.5) gives 

~3T 


2 2 
A Z (V-1) Z 

„ 2 2 
2a w T 


c 2 1 

— - — sin wT + sm 2wT 

L 2 c 4m c 


= 9.2 + 


(v 2 -1)T. 

2T 

(C.6) 


We assume the following parameters : 

v = 0.5 

A = 0.026 rad/sec 

u) = tt/ 4 rad/sec 
a 2 = 0.0002 rad 2 

T = 0.0625 sec 

Substituting those values into Eq . (C.6) and solving gives the time 

for the SPRT to reach the threshold as 

T = 2.55 sec 
c 

Using similar analysis, a QSPRT can be developed for this scale factor 
test incorporating the effects of unidentified instrument biases as 
enumerated in Section 5. 
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APPENDIX D 


SIMULTANEOUS <j> AND 0 FAILURES 


Since <£ and 0 are both measured by the vertical gyro, one 
possible failure mode would involve the simultaneous development of 
biases in both $ and 0. Suppose then that we have simultaneous 
redundancy triggers for both cj> and 0 . The basic philosophy of the 
proposed identification scheme is as follows: we use the rotational 

kinematics SPRT for tp to look for a bias in the <p measurement using 
only 0^ data in the c|)^ test and 0^ data in the test; however, 
possible 0 biases may corrupt one of these tests. We then show 
that a realistic size for this 0 bias is such that it can easily 
be picked up by translational kinematics. Combining these pieces, 
we obtain an overall identification scheme. 

Let us go through the details. Recall the basic equation 

• • 

<p = p + \p s in 0 

In this case the <t> bias manifests itself as a bias in the residual, 
and we also have the worst-case effects considered in Section 4: 
an initialization bias and a ramp due to a possible p bias. We also 
now have the possibility in the failed instrument only of a ramp 
bias of the form 


i | sin 0 - sin 0 [t (D.l) 

max 1 m 

where the [sin 0 - sin 0 ] term reflects the possible simultaneous 0 

m 

bias failure. The maximum value of ip is calculated assuming a sustained 
6g turn at Mach 0.6. This yields 

4> = 0.312 rad/sec 

max 
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We observe that the SPRT for the unfailed <f> instrument should work 
precisely as we have developed it. The only possible difficulty 
arises with the failed instrument. In this case the expectation of the 
probability ratio is given by Eq. (4.6), where the value of b must now 
reflect the term given in Eq. (D.l). For the sake of this development, 
let us set the other parameters in Eq . (4.6) as before 

M = 0.012 rad, B = 0.08 rad, a ^ = 0.0001 rad^ 

Substituting into Eq. (4.8) we obtain the following equation for the 

time T at which E (u ) crosses the failure threshold 
c n 

6400 bT^ + [575 b - 358.4]T c + 9.2 = 0 (D.2) 

We also have 

b = [.01 + .312|sin 9 - sin 6 I] (D.3) 

m 1 

where the .01 rad/sec contribution comes from possible p biases. 

Note now from Eq. (3.10) that in translational kinematics the 
error (sin 6 - sin 0^) causes a bias in of magnitude 

2 

9.8l|sin 9 - sin 0 m |m/sec (D.4) 

2 

We have already seen that we can detect a 1.5 m/sec acceleration 

bias in the longitudinal direction. Hence, we can detect a 

I sin 9 - sin 9 I error of size 
1 nr 

I sin 9 - sin 9 I > = .153 (D.5) 

in — y . oi 

Using this bound in Eq. (D.3) we have 

b = .0565 rad/sec 

and in this case 

T = .03 sec, .87 sec 

c 
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Thus we can put together the following detection system: we 

implement the <j> rotational kinematics and the translational 
kinematics SPRT's. In both cases the SPRT for the unfailed instrument 
will work correctly, thereby eliminating the problem of declaring the 
unfailed instrument to be failed. If the 0 bias is substantial (as 
defined by Eg. (D.5)), the translational kinematics will isolate the 
failed instrument. If the 0 bias is not large enough to be detected, 
it is also not large enough to corrupt the rotational kinematics 
test, which then can identify the failed vertical gyro. 
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APPENDIX E 


DESIGN AND PERFORMANCE OF AN ALTITUDE KINEMATICS FILTER 


E.l Introduction 

Altitude kinematics (AK) is the most reliable form of analytical 
redundancy available for the FDI of a normal accelerometer. However, 
the FDI process is inherently slow due to the second order differential 
relationship of AK, and is slowed down further by the QSPRT to enable 
a reliable determination of the presence or absence of the accelerometer 
failure signature in the AK residuals in the presence of initializa- 
tion errors. 

The initialization errors arise due to errors in the estimates 
of altitude and altitude rate. These estimates are used to start 
the AK residual formation process , which essentially involves a 
straightforward double integration of the relationship 


h = a 


a = a sin 6 - (a sin 4> + a cos <J>) cos 0 - g 
v x y z 


(E.l) 


The effects of errors in the estimates of h and h are a bias and ramp 
respectively in the AK residuals, thus necessitating the aforemen- 
tioned slowdown until the effect of the expected failure becomes 
comparable to the effect of the initialization errors. 


E . 2 AK Filter Design 

We discuss here some of the considerations involved in the 
design of the AK filter to help reduce the effect of initialization 
errors on the FDI process. 

The basic structure of the filter follows from Kalman filter 
considerations for the double integrator system of Eq . (E.l) and is 

given by : 


179 


(E.2) 


h = v + k. (h -h) 
1 m 


v = a + k„ (h -h) , 
v,m 2 m 


a = a sine - (a sin<J> + a cosd) ) cos8 - g 
v,m x,m m y,m m z,m r m m 


where a^ m represents the derived vertical acceleration with the sub- 
script m denoting the measurements of various quantities. Based on the 

2 

steady state Kalman gains, k 2 is selected to be equal to k-^ /2 to yield a 

filter with a damping coefficient of 0.707 and a natural frequency of 

a) = k-^/2 rad/sec. The gain k^ is chosen based on the trade-off 

consideration of keeping small the combined effect on the filter 

estimates of errors in the altimeter data and the derived vertical 
* 

acceleration . 

From Eqs . (E.l) and (E.-2) we get the following Laplace transform 

equations for e^ and e^, the errors in the estimates of altitude and 
altitude rate respectively: 


e h (s) = 


[ -a e “ < sk -i +k 2 ) h e ] + [se ho + e vo ] 


s +k 1 s+k 2 


(E . 3) 


e v ( s) = 


[-(s+k 1 )a e - sk 2 hj + [ ( s+k x ) e vo - k 2 e ho ] 


s +k^s+k 2 


(E.4) 


In the above equations, h g and a g represent errors in h m and a v m 

respectively, with e hQ and e vQ representing initial conditions on 

e, and e . 
h v 

Of main concern in the initialization errors is the effect of 
slowly varying sensor errors on the estimate of the altitude rate. 
These errors may arise due to allowable or undetectable biases in the 
accelerometers and due to the relatively hiqh level of quantization 
in the altimeter data. 


A min-max approach is adopted (consistent with the FDI approach 
for maximum reliability ) to select the gain k^ so as to minimize 

*0nly the continuous time filter is discussed here. The discrete time 
filter gains are obtained by multiplying the continuous time gains 
by the sample period T. 
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the worst case error that may occur in the presence of allowable 

biases in both h and a . Since the effect of a bias in h on 
m v,m m 

the estimate of is transient in nature, the worst case error is 

2 

calculated as follows: The steady state bias values of e ho = 

and e „ = 2a, /k. , attained in the presence of a bias a, in a , are 

VO D 1 D V / m 

assumed as the initial estimation errors existing at the onset of 

a bias change of h^ in the altimeter data, and the worst case error 

in the transient is calculated using Eg. (E.4) . It can be shown 

that the worst case error in the estimate of velocity occurs t seconds 

after the bias change in h , with t and the error given by. 


(t) 



(E.-5) 


( E . 6 ) 


where C = a^/h^. It can be shown from Eqs. (E.5) and (E.6) that 
the minimum worst case error of 


2 v = 1 - 13 /h b‘ a b 
max 


is achieved with the selection of the gain 


k* = /4.828 a b /h b 


( E 7 ) 


(E . 8 ) 


with * signifying the optimal values. Further the time of occurence 

of e * with respect to the time of the bias chanqe h^ is qiven by 
v max 


t = 


IT 

8<u ' 


(E.9) 


where w = k^/2 represents the natural frequency of the filter. 

Now, the quantization level Q in the altimeter data is substan- 
tially high with 0=30 meters in the telemetered data and.Q=3.4 
meters in the data available for onboard FDI. Further the process 
of quantization introduces a substantial nonlinearity into the problem, 
which leaves no easy way of modeling the error in the quantized output. 
However, the worst case effect of a quantum level change can be 
obtained by treating a change in the level equivalently as an onset 
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of a bias of Q/2 (half the quantization level magnitude) , corresponding 

to a situation that would arise for a flight with slowly changing 

2 

altitude. Moreover the initial error value of e, =-2a,/k, used in 

ho b 1 

the above analysis also needs to be increased by half the quantization 
level as well. It can be shown that the above considerations are 
equivalent to assuming a bias change of Q in h m with no change 
required in the value of e^ as referenced above. 

9 

Using in Eqs. (E.8) and (E.9) the values of = 0.75 m/sec 
and h^ = 30 m to correspond to half the BFM for the normal accelero- 
meter and the level of quantization in the telemetered data respective- 
ly, the optimum gain and the min-max error in the velocity estimate 
are given by: 


k* = 0.347, 

e * = 5.38 m/s. (E.10) 

max 

For the low quantization of 3.4 meters in the altimeter data avail- 
able for onboard FDI, the above values modify to 

k* = 1.03 

e * = 1.81 m/s. (E.ll) 

max 

Thus to be strictly conservative, the worst-case errors in the 
initialization estimates assumed by the AK QSPRT should be 

e h = Q 


e 


v 


(E . 12) 


E . 3 Acceleration Bias Estimation 

A steady bias in a can be estimated, and its effect on the 
. v,m 

estimates of h and h duly compensated, by employing an appropriate 

low bandwidth estimator which looks for a steady bias effect in the 

AK filter residuals , y = h -h. 

' 1 m 
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the 


Based on the optimal estimator for process noise bias'*" 1 2 , 
structure of the filter is given by 

.2 

1 / ~ ' 
a t 


• i / ~ 4 ) 

a b - r V a b ■ ~ Y / 


(E .13) 


where 


a. = estimate of the bias in a , 
b v,m 


t = time constant of the estimator, to be chosen appropriately. 

Further, the estimates of h and h provided by the AK filter can be 

corrected for the effect of the bias in a _ to yield, 

v,m ' 


h 


c 



v 


c 



where the subscript c denotes "corrected" estimates. 


(E . 14) 


Some of the factors which deserve further consideration in the 
implementation of such an estimator are as follows: 

(1) The bias estimator primarily tracks the bias in the normal 
accelerometers except during the times of large attitude maneuvers 
when the effect of biases in the other sensors (involved in the 
estimate of m ) becomes significant. A measure such as temporary 
disabling of the estimator (by setting t to a very large value) during 
times of large and sustained attitude maneuvers would help prevent 
the bias estimate from being affected by biases in sensors other than 
the normal accelerometers . 

(2) The effect on the bias estimator of transients in the AK 
filter residuals arising from altitude quantization level changes can 
be decreased by choosing the bandwidth of the bias estimator to be 
smaller than the bandwidth of the AK filter. The actual bandwidth 
chosen must be a tradeoff between sensitivity to bias changes and 
sensitivity to quantization errors in h . 
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(3) Reinitialization of the bias estimate to zero should be 
made following any change in the complement of sensors used by the 
AK filters. 

(4) In addition to improving the estimates of h and h and thus 
increasing the speed and performance of the AK FDI tests, the bias 
estimate may be employed for other tasks such as initiating FDI tests 
or on-line calibration of the normal accelerometers. 


E.4 Performance Results 


Here, we examine the performance of the filter and the estimator 

using the F-8 telemetry data from flight segment 2. Figures E-l and 

E-2 show the performance of the filter-estimator with and without 

bias in the derived vertical acceleration a , with the bias values 

v,m 

added to a being explicitly identified in the labels of the plots. 

It may be noted that the units of position, velocity and acceleration 

2 

in these figures are meters, m/sec and m/sec respectively. 

As regards the structure of the filter-estimator, the gain k^ 

is selected to be 0.347 (according to Eq. (E. 10)), and the time 

constant of the estimator is chosen to be equal to 74 seconds to 

correspond to 2 x^ where x^ = 2 tt/o) and m is the natural frequency of 

the filter. The filter is initialized at the start of the segment 

with h(t=0) = h (t=0) and h(t=0) = -2.1 m/sec, with the value for 
• m 

h chosen to correspond to the average altitude rate during the segment. 

The first two plots of Fig. E-l show the time histories of the 

altimeter data, h (t) - h (t=0) , and the vertical acceleration 
m m 

a v (t) derived from the #1 sensors, with the rest of the plots 
showing the performance of the filter with no additive bias in a 

v / in 

(i.e. a^ = 0) . The third plot shows the estimate of the altitude, 
h(t) - fi(t=0), with the altimeter data repeated for comparison; the 
fourth plot shows the altitude measurement residual history which 
exhibits a typical second order system response; and the fifth plot 
shows for comparison the velocity estimate and the predicted velocity 


v 


P 


- 2.1 + 



a 


v,m 


dt- 


The predicted velocity gives a good measure of the actual velocity 

of the aircraft except at low frequencies, where errors may arise 

due to errors in the initial velocity estimate and in the derived 

vertical .acceleration a . Thus the comparison of the time histories 

v,m r 
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of the two velocity plots gives a measure, though not a very accurate 
one, of the error in the velocity estimate arising due to quantization 
in the altimeter data. 

2 

The effects of an acceleration bias of -0.75 m/sec on the 
performance of the filter-estimator are shown in the plots of Fig. E-2 
which also show for comparison the performance of the filter-estimator 
with no bias. The acceleration bias is seen to introduce steady bias 
errors in the estimates of h, h and the h m residual. Further, the 
additional error introduced in the estimate of velocity is seen to 
be of the order of 4 m/sec leading to a maximum total error of 5 
m/sec (with respect to the predicted velocity) at about 54 seconds. 

The last three plots in Fig. E-2 show the performance of the 
bias estimator and the resulting corrected estimates of h and h. In 
the case of zero additive bias it may be seen that the estimate of 

A A A 

the bias, a fa , and hence the corrections in h and h are very small. 

With the acceleration bias, the estimator is seen to steadily improve 

its estimate of bias with time, with the bias estimate reaching a 

2 

value of -0.4 m/sec which is approximately half the actual bias 

value. The bias estimate can be expected to improve in time since the 

time constant of the estimator is large and the estimator has not 

reached steady state. The comparison of the corrected time histories 

of the estimates with and without bias also gives an indication of the 

residual error left uncorrected in the estimates of h and h when 

acceleration bias is present in a 

r v,m 

The above results demonstrate the potential of the bias estimator 
to help reduce the errors in the estimates of h and h and consequently 
enhance the speed and reliability of the AK FDI tests. The results 
also demonstrate the desirability of investigating the filter-estimator 
performance using data from a flight segment which is of significantly 
longer duration and includes large and sustained attitude maneuvers 
as well. 
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APPENDIX F 


COMPENSATION OF TURN ERROR IN DIRECTIONAL GYROS 


F.l Introduction 

The directional gyros are known to develop a systemic or predict- 
able type of error when the aircraft floor plane is not horizontal. 
Unless accounted for either in the QSPRT or by direct compensation of 
the indicated azimuth, the SPRT output using the rotational kinematics 
relations may provide erroneous FDI information, especially during 
maneuvers involving large and/or sustained attitude excursions. 

Here we derive an analytical expression for this systemic type 
of error, called turn error, for the general case when an aircraft is 
pitched as well as banked and the spin axis of the directional gyro 
is non-horizontal. Further, the flight data from four segments in- 
volving significant attitude excursions and noticeable DG drifts are 
examined in an attempt to understand the behavior of the two DG' s . 

The examination of the azimuth data reveals that the observed drift 
in the two DG's can be appropriately explained by the turn error 
calculated from the derived analytic expression. The turn error ex- 
pression involves the zero offset in the azimuth reading for each DG 
and the tilt angle of the spin axis with aspect to the horizontal in 
the case of DG 1. The estimation of these quantities is based on 
matching the observed drift in the data from segment 4A, which 
involves a steady turn of 165 degrees over a period of 38 seconds. 

The estimated quantities are used to predict the turn error for the 
other three flight segments: 4C, 2 and 3. A close match between the 
observed and the predicted error for the four flight segments indicates 
that the spin axes of the two DG's maintain their inertial position 
within expected bounds over the time of the flight spanning the four 
segments considered here. The results also indicate that unlike the 

case of DG 2, the spin axis of DG 1 is tilted by about 7° with respect 
to the horizontal. This could be due to faulty spin vector erection 
at the start of the flight or subsequent development of the tilt 
prior to the start of segment 2 . 
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The zero offset of a DG is its reading when its spin axis and 
the aircraft roll axis are collinear. Thus, the value determined 
from one flight should remain unchanged as long as the spatial 
orientation of the DG case with respect to the aircraft remains 
unchanged. With the knowledge of zero offset values the turn error 
in the azimuth data, except for the error due to a tilt of the spin 
axis from the horizontal plane, can be compensated for on-line, 
improving considerably the FDI performance in the case of rate 
gyro and/or attitude gyro failures. 

F. 2 Derivation of Turn Error Expression 

We derive here the expression for the true azimuth of the air- 
craft in terms of the azimuth indicated by the DG when the aircraft 
floor plane is tilted with respect to the horizontal plane. We 
shall consider first the case of a horizontal spin axis followed 
by the case of a non-horizontal spin axis. 

F.2.1 Horizontal Spin Axis 

Figure F-l shows the various elements of the geometry that enter 
into the determination of the turn error at any given instant of 
time. Figure F-lb shows the relative orientation of the aircraft 
and the gimbal axes with respect to the horizontal plane,with the 
two axis systems defined in Figure F-la. The angle between the aircraft 
roll axis x_ and the x gimbal axis in the floor plane of the aircraft 

■D 

represents the indicated azimuth which is read about the outer gimbal 
axis. The determination of this angle for a given azimuth orientation 
of the aircraft proceeds as follows. The spin axis is assumed to 
maintain its inertial position along x„_ in the horizontal plane. 

The orientation of the x axis with respect to the spin axis is 

13 

determined by the true azimuth <(; and the pitch and roll angles 0 

9 

and cf> respectively. With the outer gimbal axis mounted normal to the 
floor plane along z_, the x, y gimbal axes lie in the floor plane 

±3 

(i.e. x D y D plane) of the aircraft, and the orientation of the x 
gimbal axis is determined from the requirement imposed by the DG 
mounting that the spin axis lie in a plane perpendicular to the 
floor plane. 

The analytical relationship between the true and indicated aximuth 
follows from the consideration of the spherical geometry shown in 
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Fig. F-lc formed by the tips of unit vectors associated with the 
aircraft and the gimbal axes during an attitude change of the air- 
craft. The attitude change is assumed to take place in two stages: 
a pitch rotation about which changes the (x^, Y^) orientation 
to the (x_, y_) orientation, followed by a roll rotation about x_ 

.D -L ±5 

to obtain the present (x.,, y n ) orientation. The application of Napier's 
Law to the two spherical triangles formed by the tips of unit vector 
triads (x 0 , x x , x GE ) and (x B , x^, * GIM ) yields the following relations: 

sin if) cos E, = sin if) (F.l) 

y y 


cos ifi 


COS ||) ’COS 0 

v g 


(F.2) 


tan £ 


s in 8 
tan if) 


(F . 3) 


tan <Jk 


tan if) 


g 


cos (<j>+£ ) 


(F.4) 


Using Eqs (F.l), (F.2) and (F.3) in (F.4) yields after some algebra: 

tan if) . = — os — ^ tan if; - sin <j> tan 0 (F.5) 

1 cos 0 g 

or 

tan Ui = 9P S ® tan if). + sin 8 tan if) (F.6) 

g . i 

3 COS (f) 

With the knowledge of 8 and <f> from the vertical gyro, the true 
azimuth of the aircraft can be calculated using Eq . (F.6). 

The degree of severity of the turn error problem with attitude 
excursions can be seen from Fig. F-2 which shows the variation of 
turn error, c = if)^ - ifi^, with respect to the true azimuth calculated 
from Eq . (F.6) for a pitch attitude of 4 degrees and five roll 
attitude values of 15, 30, 45, 60 and 75 degrees. Thus, for example, 
in a 60 degree bank angle turn, the turn error can be as large as 
22 degrees with error changing at the rate of 0.8 degrees per degree 
turn. The turn error is seen to vary at twice the frequency of if) , 
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with the error going to zero at four headings during a 360 degree 

turn. At two of these headings, the roll axis is orthogonal to the 

spin axis with tjig = 90° and 270°. At the other two headings the 

roll axis is nearly collinear with the spin axis (i.e., ij; 2 0°, 180°). 

It can be shown from Eq . (F.5) that the extrema of the turn error 

* 

occur at given by 


* 

tan 'I' 

g 


-sin9sin<}> + (1-cos0cosi}>) v/:os9/cos<j) , 


COS0 - costj) 


(F.7) 


and the errors at the extrema are given by 


tan c 


1 

2 


( cos<)) - cos8 ) 
/cos6 cost)) 


1 

? 


(F.8) 


where C 


l-cos8cosif> + sin9sinij) (cosfl+ costj)) 

cos6-cos<(> /cOS0COS<|> (COS0-COSl)l) 


For small 6 and <J),.the turn error is approximately given by 


c 2 — (4> 2 -e 2 ) sin 2<p + 0<f> cos 2 i|> (F.9) 

4 g 9 

F . 1 . 2 Non-horizontal Spin Axis 

In the case of a non-horizontal spin axis, it can be shown that 
the turn error component c due to the non-horizontal component of 
the momentum vector is given by 


where 


sin c 


tan 5 
cos 8 


(cosijjg tan<*> 


siniJj sin0) 

g 


(F.10) 



ihg = the corrected azimuth obtained using Eq. (F.6), i.e. 

compensation assuming the spin axis to be horizontal 

6 = the tilt angle of the spin axis from the horizontal plane, 
with positive denoting a spin axis below the horizontal. 
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The derivation of Eq. (F.10) follows from the application 
of Napier's rule to the three spherical triangles shown in heavy 
outline on Fig. F-3. The definition of 6, if; and c also becomes 
clear in the context of Fig. F-3. 

It may be remarked that with no apriori knowledge of the tilt 

angle, c represents the component of turn error that cannot be 

compensated. Figure F-4 shows the amount of this irreducible 

component that could be expected at different azimuths for tilt 

angle values of 0, 5, 7.5, 10 and 15 degrees, with pitch and roll 

attitude values of 4 and 60 degrees respectively. Unlike the turn 

error variation for a horizontal spin axis seen earlier, the residual 

error c is seen to vary with the same frequency as It can be 

y 

shown that the peak error results when the x gimbal axis is horizontal 
and lies along the intersection of the floor plane of the aircraft 
and the horizontal plane. The peak error magnitude c peak is given 
by 


where 


sin c 


peak 


+ tan6 tanp 


cos p = cos0cos4> 


( F .11) 


and p represents the tilt angle of the floor plane (see Fig. F-3) . 

For small 6 and 6 , the residual turn error can be approximated 
by 


c 


S tan<f> cosij) 


( F . 1 2 ) 


Further, for small 6,4) and 6, an approximate expression for the 
total turn error c = -iJk is obtained by combining Eq. (F.9) and 
(F.12) to yield: 


[ 6 cosily +6] cos 4)^ + i-(4> 2 -9 2 ) sin 


(F . 13) 
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Figure F-4 Turn Error Due to Non-horizontal Spin Axis ' 


F,3 Results of Turn Error Compensation of Flight Dat a 

Here, we examine the results of an effort to apply the turn error 
correction to the DG data from four F-8 telemetry segments: 2, 3, 4A 
and 4C. A measure of the degree of success of this effort and also of 
the performance of the gyros is provided by examining the direct 
redundancy (DR) and the rotational kinematics (RK) residuals that 
result from the direct comparison of the compensated data for the two 
DG ' s and from the comparison against the rate gyros and vertical gyros 
using the rotational kinematic relations. 

For the four flight segments, the time histories of the pitch 

and roll attitude data from VG 1 and the indicated azimuth from 

* 

two DG's are shown in Fig. F-5 . The indicated azimuth is obtained 

In Figs. F-5 thru F-10, the units of the ordinate variables are 
radians . 



by subtracting from the DG data the zero offset of the particular DG 
under consideration, where the determination of the zero offset will 
be discussed shortly. Also shown in the figure is the difference 
in the indicated azimuth of the DG's. In the absence of any attitude 
excursions, the difference is seen to remain constant providing a 
measure of the relative orientation of the spin axes of the two 
instruments. Any deviation of the difference from this mean provides 
an indication of possible turn error in one or both of the DG's. 

Among the four segments, segment 4A involves a steady banked turn and 
is the only segment exhibiting significant turn error throughout. 

The other three segments involve essentially no-turn straight line 
flights exhibiting turn error only during large transient roll 
attitude excursions. The rest of the flight segments not considered 
here do not exhibit any noticeable DG drift in the DR or RK residuals. 

With no a priori knowledge of the zero offset for each DG, the 
turn error compensation first involves the estimation of these zero 
offset values. A rough estimate of the zero offset for each DG can 
be formed from the RK residuals obtained by using the relation 
(see Section 3.4) 


r = - 0 sin <j) + 1 J 1 cosBcostj). 

The change in the RK residual over a given time period (t,t Q ) due 
to turn error is given by 

t 

Y r (t) - Y r (t Q ) = / c cosecostj) dt (F.14) 

t 

o 

A judicious choice of a time interval and the use of simplified 
Eq. (F.9) for turn error c in Eq. (F.14) readily yields a rough 
estimate of the zero offset for each DG that could explain the observed 
change in the RK residuals. This estimate of the offset can be 
iteratively refined by using the exact turn error compensation given 
by Eq. (F.6) . 

The final results of such an effort for Segment 4A are shown 
in Fig. F-6 . The figure shows the time histories of azimuth and DR 
and RK residuals for the two DG's using both the corrected and the 
uncorrected azimuth histories signified by suffixes C and NC 
respectively. The zero offsets used in the correction are -.85 and 
-.75 radians for DG 1 and DG 2 respectively, and the RK residuals are 
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obtained using yaw rate gyro 2 . Comparison of the corrected and 
uncorrected versions of the RK residulas shows that the effect of 
turn error compensation is remarkable for DG 2, reducing the peak 
error from 0.3 radians to 0.02 radians. In the case of DG 1, the 
reduction in the peak error is not as great, although a factor 
of two reduction in the peak error is achieved. We note that in 
Fig. F-6, the nature of the variation of the RK residual for DG 1 
after compensation over the 165 degree turn is similar to the variation 
of the residual error seen in Fig. F-4 due to a non-horizontal spin 
axis. This suggests that the residual error after compensation for 
DG 1 is due not so much to an error in the estimate of zero offset 
as to a violation of the assumption of a horizontal spin axis. 

Fig. F-7 shows the result of compensation for segment 4A using 
the values of 7.5 and 0 degrees for the spin vector tilt angles for 
DG 1 and DG 2 respectively. In the case of the RK residuals for DG 1, 
residuals resulting from compensation using 0 for the spin vector 
tilt angle are shown again for comparison and marked with diamonds. 

From the RK residual plots, the degree of compensation is seen to 

be excellent for both DGs, signifying that the spin vectors maintain 
their inertial orientation during the segment with the spin vector 
dipped below the horizontal plane by approximately 7.5 degrees for DG 1. 

As remarked earlier, the zero offset value of a DG should remain 
unaltered unless the relative orientation of the DG case with respect 
to the aircraft is changed. On the other hand the spin vector orienta- 
tion depends upon the mode of spin vector erection, the mode (if any) 
employed to maintain its orientation and disturbance torques such as 
friction. However for a normal DG, the effects on the RK residuals 
of drifts due to disturbance torques and torquing employed to maintain 
the spin vector orientation should be very small. 

The same values of zero offsets and spin vector tilt angles as 

used in Fig. F-7 for segment 4A are used for turn error compensation 

for segments 2, 3 and 4C , and the results are shown in Figs. F-8 
through F-10. Unlike segment 4A, the observability of the turn error 
is limited to those times when roll attitude excursion is significant, 
with the effects of turn error and compensation most noticeable 
around the times of rapid roll attitude change. It may be remarked 
that during other times the RK residuals for both DG's show a noticeable 
contribution from the error in yaw rate gyro 2. 
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Among these three segments the most noticeable turn error is 
in DG 2 during segment 4C as seen from its uncorrected RK residuals 
in Fig. F-10, the size of the error itself being much smaller than 
the peak error observed in segment 4A. At approximately 29 
seconds there is a snap wing leveling maneuver, and the effectiveness 
of the turn error compensation can be judged with respect to the 
time when the wings are level and the turn error is thus very small. 
Although the effect of turn error compensation is not as dramatic 
as in segment 4A, nonetheless a factor of four reduction in turn 
error is achieved by compensation/ and the magnitude of the re- 
maining error on the RK residuals is sufficiently small that rate 
gyro FDI should not be affected. For the other segments where the 
uncorrected RK residuals for each DG do not show significant changes, 
the effectiveness of compensation can be judged by the absence of 
change in the corrected RK residuals around times of rapid roll 
attitude change. In the case of DG 2, there seems to be little 
if any change in the corrected RK residuals at the times of rapid 
attitude change in segments 2 and 3. Such is also the case for 
DG 1 assuming a tilt angle value of 7.5 degrees. However, using a 
zero value for the tilt angle, the change in the residuals (marked 
by diamonds) during times of significant roll attitude change is 
seen to be quite pronounced, again demonstrating the tilt of the spin 
vector for DG 1 from the horizontal plane. 

It is important to note that further refinement is undoubtedly 
possible on the zero offset estimates for the two DG's, and future 
examination of additional flight segments containing significant 
sustained attitude maneuvers would be of great help in this effort. 

F. 4 Summary and Conclusions 

In conclusion we make the following observations based on the 
results discussed above: 

(1) The spin vectors of the two DG’s maintain their inertial 
orientation within acceptable bounds during the flight time 
spanned by the segments considered here, with the spin axis 
non-horizontal for DG 1 and horizontal for DG 2. This conclusion 
derives from the observation that the drift in the RK and DR 
residuals can be explained by the systemic turn error derived 
above . 
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(2) With the knowledge of the zero offset values, which may be 
assumed invariant, the effect of turn error for a nominal DG 
with horizontal spin axis can be compensated on-line. 

(3) With turn error compensation, a rational basis now exists 
to identify faulty operation of the DG's due to causes such 

as a non-horizontal spin axis or excessive drift. The observa- 
bility of a failure mode such as non-horizontal spin axis 
depends upon the tilt angle of the spin vector and the pitch, 
roll and azimuth attitude of the aircraft. As in the case of, 
segment 3, the failure can lead to a sudden bias-type change 
in the RK residual due to a rapid attitude maneuver of the 
aircraft. Or it may manifest itself as a slowly varying change 
in the RK residuals as in the case of segment 4A, a change that 
can be identified by an SPRT looking for a ramp in the residuals. 
The SPRT 1 s looking for biases or ramps in the RK residuals 
can be initiated upon detection of a ramp or bias change in the 
direct redundancy residuals over a time window. 
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